CVE-2024-12139: Medium severity vulnerability

Published Nov 2, 2026

Updated

The error handling implementation fails to properly sanitize or validate user-supplied input within URL parameters under specific conditions. This allows end-users to manipulate the error messages that are displayed by the application.

By exploiting this vulnerability, malicious actors can inject arbitrary content into error messages. This enables them to perform social engineering attacks, such as phishing or credential theft, by replacing legitimate error messages with malicious content, misleading users into compromising sensitive information or taking harmful actions.

Event History

Nov 2, 2026

CVE Published

via NVD·06:18 PM

Data Sourced

via NVD·06:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What must an attacker do to exploit this issue?

An attacker needs to cause a user to interact with a URL containing manipulated parameters. Exploitation requires user interaction, because the malicious content is displayed in application error messages and is intended to mislead the user.

What is the likely impact on affected users?

The issue can alter the integrity of displayed error messages by injecting arbitrary content. This can support phishing or credential-theft attempts by making malicious prompts appear as legitimate application errors.

Is authentication required to exploit the vulnerability?

No. The supplied CVSS vector indicates no privileges are required, although an attacker still needs a user to interact with the crafted URL.

CVE-2024-12139: Medium severity vulnerability

Event History

Frequently Asked Questions

What must an attacker do to exploit this issue?

What is the likely impact on affected users?

Is authentication required to exploit the vulnerability?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker do to exploit this issue?

What is the likely impact on affected users?

Is authentication required to exploit the vulnerability?