CVE-2024-6541

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-6541", "assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "state": "PUBLISHED", "assignerShortName": "WSO2", "dateReserved": "2024-07-08T09:20:26.394Z", "datePublished": "2026-08-06T17:31:59.429Z", "dateUpdated": "2026-08-07T17:45:43.395Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "shortName": "WSO2", "dateUpdated": "2026-08-06T17:31:59.429Z"}, "title": "Information Disclosure and Integrity Violation via Improper Message Context Handling in Multiple WSO2 Products", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-20", "description": "CWE-20: Improper Input Validation", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-28", "descriptions": [{"lang": "en", "value": "CAPEC-28 CAPEC-28: Access Control"}]}, {"capecId": "CAPEC-17", "descriptions": [{"lang": "en", "value": "CAPEC-17 CAPEC-17: Input Validation"}]}], "affected": [{"vendor": "WSO2", "product": "WSO2 Micro Integrator", "versions": [{"status": "unknown", "version": "0", "lessThan": "1.2.0", "versionType": "custom"}, {"status": "affected", "version": "1.2.0", "lessThan": "1.2.0.163", "versionType": "custom"}, {"status": "affected", "version": "4.1.0", "lessThan": "4.1.0.103", "versionType": "custom"}, {"status": "affected", "version": "4.3.0", "lessThan": "4.3.0.7", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Enterprise Integrator", "versions": [{"status": "unknown", "version": "0", "lessThan": "6.6.0", "versionType": "custom"}, {"status": "affected", "version": "6.6.0", "lessThan": "6.6.0.205", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 API Manager", "versions": [{"status": "unknown", "version": "0", "lessThan": "3.2.0", "versionType": "custom"}, {"status": "affected", "version": "3.2.0", "lessThan": "3.2.0.394", "versionType": "custom"}, {"status": "affected", "version": "3.2.1", "lessThan": "3.2.1.21", "versionType": "custom"}, {"status": "affected", "version": "4.0.0", "lessThan": "4.0.0.311", "versionType": "custom"}, {"status": "affected", "version": "4.1.0", "lessThan": "4.1.0.167", "versionType": "custom"}, {"status": "affected", "version": "4.2.0", "lessThan": "4.2.0.110", "versionType": "custom"}, {"status": "affected", "version": "4.3.0", "lessThan": "4.3.0.24", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2-Synapse", "packageName": "org.apache.synapse:synapse-core", "versions": [{"status": "affected", "version": "2.1.7.wso2v182", "lessThan": "2.1.7.wso2v182_93", "versionType": "custom"}, {"status": "affected", "version": "2.1.7.wso2v143", "lessThan": "2.1.7.wso2v143_119", "versionType": "custom"}, {"status": "affected", "version": "2.1.7.wso2v183", "lessThan": "2.1.7.wso2v183_62", "versionType": "custom"}, {"status": "affected", "version": "2.1.7.wso2v319", "lessThan": "2.1.7.wso2v319_7", "versionType": "custom"}, {"status": "affected", "version": "2.1.7.wso2v227", "lessThan": "2.1.7.wso2v227_88", "versionType": "custom"}, {"status": "affected", "version": "2.1.7.wso2v271", "lessThan": "2.1.7.wso2v271_60", "versionType": "custom"}, {"status": "affected", "version": "4.0.0.wso2v119", "lessThan": "4.0.0.wso2v119_3", "versionType": "custom"}, {"status": "affected", "version": "4.0.0.wso2v105", "lessThan": "4.0.0.wso2v105_3", "versionType": "custom"}, {"status": "affected", "version": "4.0.0.wso2v20", "lessThan": "4.0.0.wso2v20_63", "versionType": "custom"}, {"status": "unaffected", "version": "v4.0.0-wso2v121", "lessThanOrEqual": "v4.0.0-wso2v*", "versionType": "custom"}], "defaultStatus": "unknown"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_micro_integrator:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.2.0", "versionEndExcluding": "1.2.0.163"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_micro_integrator:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.1.0", "versionEndExcluding": "4.1.0.103"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_micro_integrator:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.3.0", "versionEndExcluding": "4.3.0.7"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_enterprise_integrator:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.0", "versionEndExcluding": "6.6.0.205"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2.0", "versionEndExcluding": "3.2.0.394"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2.1", "versionEndExcluding": "3.2.1.21"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0.0", "versionEndExcluding": "4.0.0.311"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.1.0", "versionEndExcluding": "4.1.0.167"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2.0", "versionEndExcluding": "4.2.0.110"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.3.0", "versionEndExcluding": "4.3.0.24"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2-synapse:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.1.7.wso2v182", "versionEndExcluding": "2.1.7.wso2v182_93"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2-synapse:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.1.7.wso2v143", "versionEndExcluding": "2.1.7.wso2v143_119"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2-synapse:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.1.7.wso2v183", "versionEndExcluding": "2.1.7.wso2v183_62"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2-synapse:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.1.7.wso2v319", "versionEndExcluding": "2.1.7.wso2v319_7"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2-synapse:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.1.7.wso2v227", "versionEndExcluding": "2.1.7.wso2v227_88"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2-synapse:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.1.7.wso2v271", "versionEndExcluding": "2.1.7.wso2v271_60"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2-synapse:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0.0.wso2v119", "versionEndExcluding": "4.0.0.wso2v119_3"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2-synapse:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0.0.wso2v105", "versionEndExcluding": "4.0.0.wso2v105_3"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2-synapse:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0.0.wso2v20", "versionEndExcluding": "4.0.0.wso2v20_63"}, {"vulnerable": false, "criteria": "cpe:2.3:a:wso2:wso2-synapse:*:*:*:*:*:*:*:*", "versionStartIncluding": "v4.0.0-wso2v121", "versionEndIncluding": "v4.0.0-wso2v*"}]}]}], "descriptions": [{"lang": "en", "value": "The Class Mediator fails to correctly validate or sanitize `messageContext` properties when they are used to populate dynamic values. This allows authenticated users to potentially access or modify data across different system invocations that should be isolated.\n\nThis weakness can lead to the disclosure of sensitive information belonging to other users or the unintended modification of system data by authenticated users. The exact impact depends on how `messageContext` properties are utilized within the affected WSO2 products.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "The Class Mediator fails to correctly validate or sanitize `messageContext` properties when they are used to populate dynamic values. This allows authenticated users to potentially access or modify data across different system invocations that should be isolated.\n\nThis weakness can lead to the disclosure of sensitive information belonging to other users or the unintended modification of system data by authenticated users. The exact impact depends on how `messageContext` properties are utilized within the affected WSO2 products."}]}], "references": [{"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3520/", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 6.8, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N"}}], "solutions": [{"lang": "en", "value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3520/#solution https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3520/#solution", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<span style=\"background-color: transparent;\">Follow the instructions given on </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3520/#solution\"><span style=\"background-color: transparent;\">https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3520/#solution</span></a> <br>"}]}], "source": {"advisory": "WSO2-2024-3520", "discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-07T17:45:31.638289Z", "id": "CVE-2024-6541", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-07T17:45:43.395Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-6541", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-07T17:45:31.638289Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-07T17:45:37.776Z"}}], "cna": {"title": "Information Disclosure and Integrity Violation via Improper Message Context Handling in Multiple WSO2 Products", "source": {"advisory": "WSO2-2024-3520", "discovery": "INTERNAL"}, "impacts": [{"capecId": "CAPEC-28", "descriptions": [{"lang": "en", "value": "CAPEC-28 CAPEC-28: Access Control"}]}, {"capecId": "CAPEC-17", "descriptions": [{"lang": "en", "value": "CAPEC-17 CAPEC-17: Input Validation"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "WSO2", "product": "WSO2 Micro Integrator", "versions": [{"status": "unknown", "version": "0", "lessThan": "1.2.0", "versionType": "custom"}, {"status": "affected", "version": "1.2.0", "lessThan": "1.2.0.163", "versionType": "custom"}, {"status": "affected", "version": "4.1.0", "lessThan": "4.1.0.103", "versionType": "custom"}, {"status": "affected", "version": "4.3.0", "lessThan": "4.3.0.7", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Enterprise Integrator", "versions": [{"status": "unknown", "version": "0", "lessThan": "6.6.0", "versionType": "custom"}, {"status": "affected", "version": "6.6.0", "lessThan": "6.6.0.205", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 API Manager", "versions": [{"status": "unknown", "version": "0", "lessThan": "3.2.0", "versionType": "custom"}, {"status": "affected", "version": "3.2.0", "lessThan": "3.2.0.394", "versionType": "custom"}, {"status": "affected", "version": "3.2.1", "lessThan": "3.2.1.21", "versionType": "custom"}, {"status": "affected", "version": "4.0.0", "lessThan": "4.0.0.311", "versionType": "custom"}, {"status": "affected", "version": "4.1.0", "lessThan": "4.1.0.167", "versionType": "custom"}, {"status": "affected", "version": "4.2.0", "lessThan": "4.2.0.110", "versionType": "custom"}, {"status": "affected", "version": "4.3.0", "lessThan": "4.3.0.24", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2-Synapse", "versions": [{"status": "affected", "version": "2.1.7.wso2v182", "lessThan": "2.1.7.wso2v182_93", "versionType": "custom"}, {"status": "affected", "version": "2.1.7.wso2v143", "lessThan": "2.1.7.wso2v143_119", "versionType": "custom"}, {"status": "affected", "version": "2.1.7.wso2v183", "lessThan": "2.1.7.wso2v183_62", "versionType": "custom"}, {"status": "affected", "version": "2.1.7.wso2v319", "lessThan": "2.1.7.wso2v319_7", "versionType": "custom"}, {"status": "affected", "version": "2.1.7.wso2v227", "lessThan": "2.1.7.wso2v227_88", "versionType": "custom"}, {"status": "affected", "version": "2.1.7.wso2v271", "lessThan": "2.1.7.wso2v271_60", "versionType": "custom"}, {"status": "affected", "version": "4.0.0.wso2v119", "lessThan": "4.0.0.wso2v119_3", "versionType": "custom"}, {"status": "affected", "version": "4.0.0.wso2v105", "lessThan": "4.0.0.wso2v105_3", "versionType": "custom"}, {"status": "affected", "version": "4.0.0.wso2v20", "lessThan": "4.0.0.wso2v20_63", "versionType": "custom"}, {"status": "unaffected", "version": "v4.0.0-wso2v121", "versionType": "custom", "lessThanOrEqual": "v4.0.0-wso2v*"}], "packageName": "org.apache.synapse:synapse-core", "defaultStatus": "unknown"}], "solutions": [{"lang": "en", "value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3520/#solution https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3520/#solution", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: transparent;\">Follow the instructions given on </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3520/#solution\"><span style=\"background-color: transparent;\">https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3520/#solution</span></a> <br>", "base64": false}]}], "references": [{"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3520/", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "The Class Mediator fails to correctly validate or sanitize `messageContext` properties when they are used to populate dynamic values. This allows authenticated users to potentially access or modify data across different system invocations that should be isolated.\n\nThis weakness can lead to the disclosure of sensitive information belonging to other users or the unintended modification of system data by authenticated users. The exact impact depends on how `messageContext` properties are utilized within the affected WSO2 products.", "supportingMedia": [{"type": "text/html", "value": "The Class Mediator fails to correctly validate or sanitize `messageContext` properties when they are used to populate dynamic values. This allows authenticated users to potentially access or modify data across different system invocations that should be isolated.\n\nThis weakness can lead to the disclosure of sensitive information belonging to other users or the unintended modification of system data by authenticated users. The exact impact depends on how `messageContext` properties are utilized within the affected WSO2 products.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20: Improper Input Validation"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wso2:wso2_micro_integrator:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.2.0.163", "versionStartIncluding": "1.2.0"}, {"criteria": "cpe:2.3:a:wso2:wso2_micro_integrator:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.1.0.103", "versionStartIncluding": "4.1.0"}, {"criteria": "cpe:2.3:a:wso2:wso2_micro_integrator:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.3.0.7", "versionStartIncluding": "4.3.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wso2:wso2_enterprise_integrator:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.0.205", "versionStartIncluding": "6.6.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "3.2.0.394", "versionStartIncluding": "3.2.0"}, {"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "3.2.1.21", "versionStartIncluding": "3.2.1"}, {"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.0.0.311", "versionStartIncluding": "4.0.0"}, {"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.1.0.167", "versionStartIncluding": "4.1.0"}, {"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.2.0.110", "versionStartIncluding": "4.2.0"}, {"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.3.0.24", "versionStartIncluding": "4.3.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wso2:wso2-synapse:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.1.7.wso2v182_93", "versionStartIncluding": "2.1.7.wso2v182"}, {"criteria": "cpe:2.3:a:wso2:wso2-synapse:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.1.7.wso2v143_119", "versionStartIncluding": "2.1.7.wso2v143"}, {"criteria": "cpe:2.3:a:wso2:wso2-synapse:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.1.7.wso2v183_62", "versionStartIncluding": "2.1.7.wso2v183"}, {"criteria": "cpe:2.3:a:wso2:wso2-synapse:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.1.7.wso2v319_7", "versionStartIncluding": "2.1.7.wso2v319"}, {"criteria": "cpe:2.3:a:wso2:wso2-synapse:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.1.7.wso2v227_88", "versionStartIncluding": "2.1.7.wso2v227"}, {"criteria": "cpe:2.3:a:wso2:wso2-synapse:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.1.7.wso2v271_60", "versionStartIncluding": "2.1.7.wso2v271"}, {"criteria": "cpe:2.3:a:wso2:wso2-synapse:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.0.0.wso2v119_3", "versionStartIncluding": "4.0.0.wso2v119"}, {"criteria": "cpe:2.3:a:wso2:wso2-synapse:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.0.0.wso2v105_3", "versionStartIncluding": "4.0.0.wso2v105"}, {"criteria": "cpe:2.3:a:wso2:wso2-synapse:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.0.0.wso2v20_63", "versionStartIncluding": "4.0.0.wso2v20"}, {"criteria": "cpe:2.3:a:wso2:wso2-synapse:*:*:*:*:*:*:*:*", "vulnerable": false, "versionEndIncluding": "v4.0.0-wso2v*", "versionStartIncluding": "v4.0.0-wso2v121"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "shortName": "WSO2", "dateUpdated": "2026-08-06T17:31:59.429Z"}}}, "cveMetadata": {"cveId": "CVE-2024-6541", "state": "PUBLISHED", "dateUpdated": "2026-08-07T17:45:43.395Z", "dateReserved": "2024-07-08T09:20:26.394Z", "assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "datePublished": "2026-08-06T17:31:59.429Z", "assignerShortName": "WSO2"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WSO2 Micro Integrator", "vendor": "WSO2", "versions": [{"lessThan": "1.2.0", "status": "unknown", "version": "0", "versionType": "custom"}, {"lessThan": "1.2.0.163", "status": "affected", "version": "1.2.0", "versionType": "custom"}, {"lessThan": "4.1.0.103", "status": "affected", "version": "4.1.0", "versionType": "custom"}, {"lessThan": "4.3.0.7", "status": "affected", "version": "4.3.0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "WSO2 Enterprise Integrator", "vendor": "WSO2", "versions": [{"lessThan": "6.6.0", "status": "unknown", "version": "0", "versionType": "custom"}, {"lessThan": "6.6.0.205", "status": "affected", "version": "6.6.0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "WSO2 API Manager", "vendor": "WSO2", "versions": [{"lessThan": "3.2.0", "status": "unknown", "version": "0", "versionType": "custom"}, {"lessThan": "3.2.0.394", "status": "affected", "version": "3.2.0", "versionType": "custom"}, {"lessThan": "3.2.1.21", "status": "affected", "version": "3.2.1", "versionType": "custom"}, {"lessThan": "4.0.0.311", "status": "affected", "version": "4.0.0", "versionType": "custom"}, {"lessThan": "4.1.0.167", "status": "affected", "version": "4.1.0", "versionType": "custom"}, {"lessThan": "4.2.0.110", "status": "affected", "version": "4.2.0", "versionType": "custom"}, {"lessThan": "4.3.0.24", "status": "affected", "version": "4.3.0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "packageName": "org.apache.synapse:synapse-core", "product": "WSO2-Synapse", "vendor": "WSO2", "versions": [{"lessThan": "2.1.7.wso2v182_93", "status": "affected", "version": "2.1.7.wso2v182", "versionType": "custom"}, {"lessThan": "2.1.7.wso2v143_119", "status": "affected", "version": "2.1.7.wso2v143", "versionType": "custom"}, {"lessThan": "2.1.7.wso2v183_62", "status": "affected", "version": "2.1.7.wso2v183", "versionType": "custom"}, {"lessThan": "2.1.7.wso2v319_7", "status": "affected", "version": "2.1.7.wso2v319", "versionType": "custom"}, {"lessThan": "2.1.7.wso2v227_88", "status": "affected", "version": "2.1.7.wso2v227", "versionType": "custom"}, {"lessThan": "2.1.7.wso2v271_60", "status": "affected", "version": "2.1.7.wso2v271", "versionType": "custom"}, {"lessThan": "4.0.0.wso2v119_3", "status": "affected", "version": "4.0.0.wso2v119", "versionType": "custom"}, {"lessThan": "4.0.0.wso2v105_3", "status": "affected", "version": "4.0.0.wso2v105", "versionType": "custom"}, {"lessThan": "4.0.0.wso2v20_63", "status": "affected", "version": "4.0.0.wso2v20", "versionType": "custom"}, {"lessThanOrEqual": "v4.0.0-wso2v*", "status": "unaffected", "version": "v4.0.0-wso2v121", "versionType": "custom"}]}], "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Class Mediator fails to correctly validate or sanitize `messageContext` properties when they are used to populate dynamic values. This allows authenticated users to potentially access or modify data across different system invocations that should be isolated.\n\nThis weakness can lead to the disclosure of sensitive information belonging to other users or the unintended modification of system data by authenticated users. The exact impact depends on how `messageContext` properties are utilized within the affected WSO2 products."}, {"lang": "es", "value": "El Class Mediator no valida o sanea correctamente las propiedades \u201cmessageContext\u201d cuando se utilizan para poblar valores din\u00e1micos. Esto permite a usuarios autenticados acceder o modificar potencialmente datos entre diferentes invocaciones del sistema que deber\u00edan estar aisladas.\n\nEsta debilidad puede llevar a la divulgaci\u00f3n de informaci\u00f3n sensible perteneciente a otros usuarios o a la modificaci\u00f3n no intencionada de datos del sistema por parte de usuarios autenticados. El impacto exacto depende de c\u00f3mo se utilizan las propiedades \u201cmessageContext\u201d dentro de los productos WSO2 afectados."}], "id": "CVE-2024-6541", "lastModified": "2026-10-27T18:10:00.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.2, "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-6541", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-07T17:45:31.638289Z", "version": "2.0.3"}}]}, "published": "2026-08-06T22:16:40.557", "references": [{"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3520/"}], "sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1.2.0,1.2.0.163)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.1.0,4.1.0.103)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.3.0,4.3.0.7)"}}], "enrichment": {"confidence": 89.0, "confidence_source": "matching", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 89.0, "source": "matching"}]}, "original": {"product": "WSO2 Micro Integrator", "source": "cna", "vendor": "WSO2"}, "product": "micro_integrator", "vendor": "wso2"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[2.1.7.wso2v182,2.1.7.wso2v182_93)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[2.1.7.wso2v143,2.1.7.wso2v143_119)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[2.1.7.wso2v183,2.1.7.wso2v183_62)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[2.1.7.wso2v319,2.1.7.wso2v319_7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[2.1.7.wso2v227,2.1.7.wso2v227_88)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[2.1.7.wso2v271,2.1.7.wso2v271_60)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.0.0.wso2v119,4.0.0.wso2v119_3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.0.0.wso2v105,4.0.0.wso2v105_3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.0.0.wso2v20,4.0.0.wso2v20_63)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[v4.0.0-wso2v121,v4.0.0-wso2v*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "WSO2-Synapse", "source": "cna", "vendor": "WSO2"}, "product": "wso2-synapse", "vendor": "wso2"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[3.2.0,3.2.0.394)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[3.2.1,3.2.1.21)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.0.0,4.0.0.311)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.1.0,4.1.0.167)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.2.0,4.2.0.110)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.3.0,4.3.0.24)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "WSO2 API Manager", "source": "cna", "vendor": "WSO2"}, "product": "wso2_api_manager", "vendor": "wso2"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[6.6.0,6.6.0.205)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "WSO2 Enterprise Integrator", "source": "cna", "vendor": "WSO2"}, "product": "wso2_enterprise_integrator", "vendor": "wso2"}], "created": "2026-08-06T23:30:05.253142+00:00", "updated": "2026-08-07T09:59:13.649901+00:00", "vendors": ["wso2", "wso2$PRODUCT$micro_integrator", "wso2$PRODUCT$wso2-synapse", "wso2$PRODUCT$wso2_api_manager", "wso2$PRODUCT$wso2_enterprise_integrator"]}