CVE-2024-10302

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-10302
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-10302.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-10302
Published
2026-08-06T08:16:26.920Z
Modified
2026-08-11T03:45:24.963392197Z
Severity
  • 5.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N CVSS Calculator
Summary
[none]
Details

The user self-signup flow in multiple WSO2 products fails to adequately validate user-supplied input. This weakness allows arbitrary unvalidated data to be included within user claims, which are then used by downstream processes.

Allowing unvalidated input into user claims can lead to various security risks. Malicious or malformed data injected during signup could be processed by other parts of the application, potentially enabling attacks such as content manipulation, redirection, user interface inconsistencies, unauthorized actions, and data exposure. The actual impact depends on how the compromised data is consumed and the privileges associated with the affected users.

Database specific 
{
    "unresolved_ranges": [
        {
            "source": "CPE_STRING",
            "cpes": [
                "cpe:2.3:a:wso2:api_control_plane:4.5.0:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "4.5.0"
                },
                {
                    "last_affected": "4.5.0"
                }
            ],
            "vendor_product": "wso2:api_control_plane"
        },
        {
            "source": "CPE_STRING",
            "cpes": [
                "cpe:2.3:a:wso2:api_manager:3.2.1:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "3.2.1"
                },
                {
                    "last_affected": "3.2.1"
                }
            ],
            "vendor_product": "wso2:api_manager"
        },
        {
            "source": "CPE_STRING",
            "cpes": [
                "cpe:2.3:a:wso2:identity_server:5.10.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:wso2:identity_server:5.11.0:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "5.10.0"
                },
                {
                    "last_affected": "5.10.0"
                },
                {
                    "introduced": "5.11.0"
                },
                {
                    "last_affected": "5.11.0"
                }
            ],
            "vendor_product": "wso2:identity_server"
        },
        {
            "cpes": [
                "cpe:2.3:a:wso2:identity_server_as_key_manager:5.10.0:*:*:*:*:*:*:*"
            ],
            "source": "CPE_STRING",
            "extracted_events": [
                {
                    "introduced": "5.10.0"
                },
                {
                    "last_affected": "5.10.0"
                }
            ],
            "vendor_product": "wso2:identity_server_as_key_manager"
        },
        {
            "cpes": [
                "cpe:2.3:a:wso2:open_banking_iam:2.0.0:*:*:*:*:*:*:*"
            ],
            "source": "CPE_STRING",
            "extracted_events": [
                {
                    "introduced": "2.0.0"
                },
                {
                    "last_affected": "2.0.0"
                }
            ],
            "vendor_product": "wso2:open_banking_iam"
        },
        {
            "cpes": [
                "cpe:2.3:a:wso2:traffic_manager:4.5.0:*:*:*:*:*:*:*"
            ],
            "source": "CPE_STRING",
            "extracted_events": [
                {
                    "introduced": "4.5.0"
                },
                {
                    "last_affected": "4.5.0"
                }
            ],
            "vendor_product": "wso2:traffic_manager"
        },
        {
            "cpes": [
                "cpe:2.3:a:wso2:universal_gateway:4.5.0:*:*:*:*:*:*:*"
            ],
            "source": "CPE_STRING",
            "extracted_events": [
                {
                    "introduced": "4.5.0"
                },
                {
                    "last_affected": "4.5.0"
                }
            ],
            "vendor_product": "wso2:universal_gateway"
        }
    ]
}
References

Affected packages

Git / github.com/wso2/product-apim

Affected ranges

Type
GIT
Repo
https://github.com/wso2/product-apim
Events
Introduced
2971de274564b622974de831403e9688a4a76c14
Last affected
f84a64d6683176f3ffb57fa262f3035b69781f2f
Database specific
Show details 
{
    "source": "CPE_STRING",
    "cpe": [
        "cpe:2.3:a:wso2:api_manager:3.1.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:wso2:api_manager:3.2.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:wso2:api_manager:4.0.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:wso2:api_manager:4.1.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:wso2:api_manager:4.2.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:wso2:api_manager:4.3.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:wso2:api_manager:4.5.0:*:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "3.1.0"
        },
        {
            "last_affected": "3.1.0"
        },
        {
            "introduced": "3.2.0"
        },
        {
            "last_affected": "3.2.0"
        },
        {
            "introduced": "4.0.0"
        },
        {
            "last_affected": "4.0.0"
        },
        {
            "introduced": "4.1.0"
        },
        {
            "last_affected": "4.1.0"
        },
        {
            "introduced": "4.2.0"
        },
        {
            "last_affected": "4.2.0"
        },
        {
            "introduced": "4.3.0"
        },
        {
            "last_affected": "4.3.0"
        },
        {
            "introduced": "4.5.0"
        },
        {
            "last_affected": "4.5.0"
        }
    ]
}

Affected versions

3.*
3.1.0
3.2.0
4.*
4.0.0
4.0.0-beta
4.1.0
4.2.0
4.3.0
4.5.0
v3.*
v3.1.0
v3.1.0-rc3
v3.2.0
v3.2.0-alpha
v3.2.0-beta
v3.2.0-m1
v3.2.0-rc1
v3.2.0-rc2
v3.2.0-rc3
v3.2.0-rc4
v3.2.0-rc5
v3.2.0-rc6
v4.*
v4.0.0
v4.0.0-alpha
v4.0.0-beta
v4.0.0-m1
v4.0.0-m2
v4.0.0-m3
v4.0.0-m4
v4.0.0-m5
v4.0.0-m6
v4.0.0-m7
v4.0.0-m8
v4.0.0-rc
v4.1.0
v4.1.0-alpha
v4.1.0-beta
v4.1.0-m1
v4.1.0-m2
v4.1.0-m3
v4.1.0-m4
v4.1.0-rc
v4.1.0-rc2
v4.1.0-rc3
v4.2.0
v4.2.0-alpha
v4.2.0-beta
v4.2.0-m1
v4.2.0-rc
v4.2.0-rc2
v4.3.0
v4.3.0-alpha
v4.3.0-alpha2
v4.3.0-beta
v4.3.0-m2
v4.3.0-rc
v4.3.0-rc2
v4.4.0
v4.4.0-alpha
v4.4.0-beta
v4.4.0-m1
v4.4.0-rc
v4.4.0-rc2
v4.5.0-acp
v4.5.0-acp-alpha
v4.5.0-acp-beta
v4.5.0-acp-m1
v4.5.0-acp-rc
v4.5.0-acp-rc2
v4.5.0-beta
v4.5.0-gw-alpha
v4.5.0-gw-beta
v4.5.0-gw-m1
v4.5.0-gw-rc
v4.5.0-m1
v4.5.0-m2
v4.5.0-rc
v4.5.0-tm
v4.5.0-tm-alpha
v4.5.0-tm-beta
v4.5.0-tm-m1
v4.5.0-tm-rc
v4.5.0-tm-rc2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-10302.json"