VulnerabilityAnalyzed

CVE-2024-6429

A content spoofing vulnerability exists in multiple WSO2 products due to improper error message handling.

MEDIUM 4.3EPSS 0.21%

Does this matter?

Lower severity and a low EPSS score (0.21%). Track it; it rarely justifies an emergency change on its own.

Description

A content spoofing vulnerability exists in multiple WSO2 products due to improper error message handling. Under certain conditions, error messages are passed through URL parameters without validation, allowing malicious actors to inject arbitrary content into the UI. By exploiting this vulnerability, attackers can manipulate browser-displayed error messages, enabling social engineering attacks through deceptive or misleading content.

CVSS 3.1: 4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
EPSS: 0.21% probability · 12th percentile
CISA KEV: Not listed
Weakness: CWE-451
Affected: wso2/api manager · wso2/identity server
Source: ed10eef1-636d-4fbe-9993-6890dfa878f8

References

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2024-3490/Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.