CVE-2024-4412: Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations
The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment.
Exploitation of this vulnerability requires administrator privileges. The impact is minimal as EL usage is restricted to certain read operations.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
Exploitation requires administrator privileges. It is therefore primarily relevant where an administrator account has been compromised or an untrusted party has been granted administrative access.
What can successful exploitation do?
Malicious Expression Language code can cause arbitrary operations within the affected deployment. The stated impact is limited because EL use is restricted to certain read operations, with confidentiality impact rated low and no integrity or availability impact listed.
How can exposure be reduced if remediation cannot be applied immediately?
Restrict administrator privileges to trusted users and protect administrative accounts from compromise. Since exploitation depends on administrator access, reviewing and minimizing administrative access reduces the immediate exposure.