CVE-2024-3509

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-3509
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-3509.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-3509
Published
2025-06-02T17:15:22.090Z
Modified
2026-07-08T08:11:44.602958964Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

A stored cross-site scripting (XSS) vulnerability exists in the Management Console of multiple WSO2 products due to insufficient input validation in the Rich Text Editor within the registry section. To exploit this vulnerability, a malicious actor must have a valid user account with administrative access to the Management Console. If successful, the actor could inject persistent JavaScript payloads, enabling the theft of user data or execution of unauthorized actions on behalf of other users.

While this issue enables persistent client-side script execution, session-related cookies remain protected with the httpOnly flag, preventing session hijacking.

Database specific 
{
    "unresolved_ranges": [
        {
            "vendor_product": "wso2:api_manager",
            "cpes": [
                "cpe:2.3:a:wso2:api_manager:3.2.1:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "3.2.1"
                },
                {
                    "last_affected": "3.2.1"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "vendor_product": "wso2:identity_server",
            "cpes": [
                "cpe:2.3:a:wso2:identity_server:5.10.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:wso2:identity_server:5.11.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:wso2:identity_server:6.0.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:wso2:identity_server:6.1.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:wso2:identity_server:7.0.0:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "5.10.0"
                },
                {
                    "last_affected": "5.10.0"
                },
                {
                    "introduced": "5.11.0"
                },
                {
                    "last_affected": "5.11.0"
                },
                {
                    "introduced": "6.0.0"
                },
                {
                    "last_affected": "6.0.0"
                },
                {
                    "introduced": "6.1.0"
                },
                {
                    "last_affected": "6.1.0"
                },
                {
                    "introduced": "7.0.0"
                },
                {
                    "last_affected": "7.0.0"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "vendor_product": "wso2:identity_server_as_key_manager",
            "cpes": [
                "cpe:2.3:a:wso2:identity_server_as_key_manager:5.10.0:*:*:*:*:*:*:*"
            ],
            "source": "CPE_STRING",
            "extracted_events": [
                {
                    "introduced": "5.10.0"
                },
                {
                    "last_affected": "5.10.0"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/wso2/product-apim

Affected ranges

Type
GIT
Repo
https://github.com/wso2/product-apim
Events
Introduced
e4956e9301b1c26eb06e80ec5c86628154b6ab55
Last affected
6e7a9db24a575f1f4a5bc4f4cbb41687c308c466
Database specific
Show details 
{
    "cpe": [
        "cpe:2.3:a:wso2:api_manager:3.2.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:wso2:api_manager:4.0.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:wso2:api_manager:4.1.0:-:*:*:*:*:*:*",
        "cpe:2.3:a:wso2:api_manager:4.2.0:-:*:*:*:*:*:*",
        "cpe:2.3:a:wso2:api_manager:4.3.0:-:*:*:*:*:*:*"
    ],
    "source": "CPE_STRING",
    "extracted_events": [
        {
            "introduced": "3.2.0"
        },
        {
            "last_affected": "3.2.0"
        },
        {
            "introduced": "4.0.0"
        },
        {
            "last_affected": "4.0.0"
        },
        {
            "introduced": "4.1.0-NA"
        },
        {
            "last_affected": "4.1.0-NA"
        },
        {
            "introduced": "4.2.0-NA"
        },
        {
            "last_affected": "4.2.0-NA"
        },
        {
            "introduced": "4.3.0-NA"
        },
        {
            "last_affected": "4.3.0-NA"
        }
    ]
}

Affected versions

3.*
3.2.0
4.*
4.0.0
4.0.0-beta
4.1.0-NA
4.2.0-NA
4.3.0-NA
v3.*
v3.2.0
v3.2.0-rc6
v4.*
v4.0.0
v4.0.0-alpha
v4.0.0-beta
v4.0.0-m1
v4.0.0-m2
v4.0.0-m3
v4.0.0-m4
v4.0.0-m5
v4.0.0-m6
v4.0.0-m7
v4.0.0-m8
v4.0.0-rc
v4.1.0
v4.1.0-alpha
v4.1.0-beta
v4.1.0-m1
v4.1.0-m2
v4.1.0-m3
v4.1.0-m4
v4.1.0-rc
v4.1.0-rc2
v4.1.0-rc3
v4.2.0
v4.2.0-alpha
v4.2.0-beta
v4.2.0-m1
v4.2.0-rc
v4.2.0-rc2
v4.3.0
v4.3.0-alpha
v4.3.0-alpha2
v4.3.0-beta
v4.3.0-m2
v4.3.0-rc
v4.3.0-rc2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-3509.json"

Git / github.com/wso2/product-ei

Affected ranges

Type
GIT
Repo
https://github.com/wso2/product-ei
Events
Introduced
bfdf341ab6dcfccce35c88b8a1567604f07ba8f5
Last affected
bfdf341ab6dcfccce35c88b8a1567604f07ba8f5
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:wso2:enterprise_integrator:6.6.0:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "6.6.0"
        },
        {
            "last_affected": "6.6.0"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

6.*
6.6.0
v6.*
v6.6.0
v6.6.0-rc3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-3509.json"