{"affected":[{"defaultStatus":"unaffected","product":"WSO2 Open Banking AM","source":"CNA: WSO2","vendor":"WSO2","versions":[{"lessThan":"2.0.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"2.0.0.383","status":"affected","version":"2.0.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 API Manager","source":"CNA: WSO2","vendor":"WSO2","versions":[{"lessThan":"3.0.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"3.0.0.160","status":"affected","version":"3.0.0","versionType":"custom"},{"lessThan":"3.1.0.335","status":"affected","version":"3.1.0","versionType":"custom"},{"lessThan":"3.2.0.432","status":"affected","version":"3.2.0","versionType":"custom"},{"lessThan":"3.2.1.51","status":"affected","version":"3.2.1","versionType":"custom"},{"lessThan":"4.0.0.310","status":"affected","version":"4.0.0","versionType":"custom"},{"lessThan":"4.1.0.208","status":"affected","version":"4.1.0","versionType":"custom"},{"lessThan":"4.2.0.146","status":"affected","version":"4.2.0","versionType":"custom"},{"lessThan":"4.3.0.59","status":"affected","version":"4.3.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Identity Server as Key Manager","source":"CNA: WSO2","vendor":"WSO2","versions":[{"lessThan":"5.9.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"5.9.0.163","status":"affected","version":"5.9.0","versionType":"custom"},{"lessThan":"5.10.0.355","status":"affected","version":"5.10.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Open Banking IAM","source":"CNA: WSO2","vendor":"WSO2","versions":[{"lessThan":"2.0.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"2.0.0.404","status":"affected","version":"2.0.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Enterprise Integrator","source":"CNA: WSO2","vendor":"WSO2","versions":[{"lessThan":"6.6.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"6.6.0.212","status":"affected","version":"6.6.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Identity Server","source":"CNA: WSO2","vendor":"WSO2","versions":[{"lessThan":"5.9.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"5.9.0.154","status":"affected","version":"5.9.0","versionType":"custom"},{"lessThan":"5.10.0.291","status":"affected","version":"5.10.0","versionType":"custom"},{"lessThan":"5.11.0.371","status":"affected","version":"5.11.0","versionType":"custom"},{"lessThan":"6.0.0.178","status":"affected","version":"6.0.0","versionType":"custom"},{"lessThan":"6.1.0.134","status":"affected","version":"6.1.0","versionType":"custom"}]},{"defaultStatus":"unknown","packageName":"org.wso2.carbon:org.wso2.carbon.registry.core","product":"WSO2 Carbon Registry Kernel","source":"CNA: WSO2","vendor":"WSO2","versions":[{"lessThan":"4.5.1.36","status":"affected","version":"4.5.1","versionType":"custom"},{"lessThan":"4.5.3.36","status":"affected","version":"4.5.3","versionType":"custom"},{"lessThan":"4.6.0.139","status":"affected","version":"4.6.0","versionType":"custom"},{"lessThan":"4.6.0.1544","status":"affected","version":"4.6.0","versionType":"custom"},{"lessThan":"4.6.1.105","status":"affected","version":"4.6.1","versionType":"custom"},{"lessThan":"4.6.2.321","status":"affected","version":"4.6.2","versionType":"custom"},{"lessThan":"4.6.3.28","status":"affected","version":"4.6.3","versionType":"custom"},{"lessThan":"4.6.4.11","status":"affected","version":"4.6.4","versionType":"custom"},{"lessThan":"4.7.1.47","status":"affected","version":"4.7.1","versionType":"custom"},{"lessThan":"4.8.1.27","status":"affected","version":"4.8.1","versionType":"custom"},{"lessThan":"4.8.1.31","status":"affected","version":"4.8.1","versionType":"custom"},{"lessThan":"4.9.0.46","status":"affected","version":"4.9.0","versionType":"custom"},{"lessThan":"4.9.26.18","status":"affected","version":"4.9.26","versionType":"custom"}]}],"cveId":"CVE-2024-2372","cwes":["CWE-601"],"description":"The affected components accept user-supplied input for constructing redirection URLs without enforcing expected validation constraints. This allows an attacker to provide a crafted URL that can redirect users to an arbitrary external domain.\n\nBy leveraging this open redirection vulnerability, an attacker can craft a malicious link that, when clicked by a user, redirects them to an attacker-controlled page. This can be used in conjunction with social engineering techniques to execute phishing attacks, aiming to obtain sensitive information or cause other harm.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":5.4,"severity":"medium","source":"CNA: WSO2","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},{"score":5.4,"severity":"medium","source":"NVD: ed10eef1-636d-4fbe-9993-6890dfa878f8","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","version":"3.1"}],"modifiedAt":1793618248460,"publishedAt":1793617223105,"references":[{"source":"CNA: WSO2","tags":["vendor-advisory"],"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3254/"},{"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","tags":[],"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3254/"}],"remediation":[{"kind":"fix","source":"CNA: WSO2","text":"Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3254/#solution"}],"revision":"556f72e848b32ac183b4c3e6e5fc83802c5f096aafd56c7797bd2173cbe58f4c","sources":[{"modifiedAt":1793617223105,"name":"CNA: WSO2","retrievedAt":1793621299742,"url":"https://www.cve.org/CVERecord?id=CVE-2024-2372"},{"modifiedAt":1793618248460,"name":"NVD","retrievedAt":1793621817109,"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-2372"}],"ssvc":null,"status":"published","title":"Open Redirection via Unsanitized User Input in Multiple WSO2 Products Allows Phishing Attacks","updatedAt":1793621817109}