By leveraging this open redirection vulnerability, an attacker can craft a malicious link that, when clicked by a user, redirects them to an attacker-controlled page. This can be used in conjunction with social engineering techniques to execute phishing attacks, aiming to obtain sensitive information or cause other harm.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| WSO2 | WSO2 Open Banking AM | unaffected |
|
||||||||||||||||||||||||||||||||||||||||||
| WSO2 | WSO2 API Manager | unaffected |
|
||||||||||||||||||||||||||||||||||||||||||
| WSO2 | WSO2 Identity Server as Key Manager | unaffected |
|
||||||||||||||||||||||||||||||||||||||||||
| WSO2 | WSO2 Open Banking IAM | unaffected |
|
||||||||||||||||||||||||||||||||||||||||||
| WSO2 | WSO2 Enterprise Integrator | unaffected |
|
||||||||||||||||||||||||||||||||||||||||||
| WSO2 | WSO2 Identity Server | unaffected |
|
||||||||||||||||||||||||||||||||||||||||||
| WSO2 | WSO2 Carbon Registry Kernel | unknown |
|
No data.
No data.
No data available yet.
Vendor Solution
Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3254/#solution
Tracking
Sign in to view the affected projects.
No advisories yet.
Mon, 02 Nov 2026 11:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The affected components accept user-supplied input for constructing redirection URLs without enforcing expected validation constraints. This allows an attacker to provide a crafted URL that can redirect users to an arbitrary external domain. By leveraging this open redirection vulnerability, an attacker can craft a malicious link that, when clicked by a user, redirects them to an attacker-controlled page. This can be used in conjunction with social engineering techniques to execute phishing attacks, aiming to obtain sensitive information or cause other harm. | |
| Title | Open Redirection via Unsanitized User Input in Multiple WSO2 Products Allows Phishing Attacks | |
| First Time appeared |
Wso2
Wso2 wso2 Api Manager Wso2 wso2 Carbon Registry Kernel Wso2 wso2 Enterprise Integrator Wso2 wso2 Identity Server Wso2 wso2 Identity Server As Key Manager Wso2 wso2 Open Banking Am Wso2 wso2 Open Banking Iam |
|
| Weaknesses | CWE-601 | |
| CPEs | cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_registry_kernel:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_enterprise_integrator:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:* |
|
| Vendors & Products |
Wso2
Wso2 wso2 Api Manager Wso2 wso2 Carbon Registry Kernel Wso2 wso2 Enterprise Integrator Wso2 wso2 Identity Server Wso2 wso2 Identity Server As Key Manager Wso2 wso2 Open Banking Am Wso2 wso2 Open Banking Iam |
|
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: WSO2
Published:
Updated: 2026-11-02T11:00:23.105Z
Reserved: 2024-03-11T13:20:39.998Z
Link: CVE-2024-2372
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-02T11:17:28.460
Modified: 2026-11-02T11:17:28.460
Link: CVE-2024-2372
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-11-02T12:30:15Z
-
CWE-601
URL Redirection to Untrusted Site ('Open Redirect')