CVE-2024-6423: Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information Leakage
The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its acceptance could lead to logging.
If a user mistakenly sends sensitive data via URL parameters to any flow, this data could be inadvertently logged in access logs. This has the potential to expose confidential information, compromising the security and privacy of affected systems if the product is used incorrectly.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Deployments are exposed when users send sensitive data in URL parameters to product flows. The data is not used by the product, but it may be recorded in access logs and become available to parties with access to those logs.
What does an attacker need to exploit this vulnerability?
Exploitation requires a user to mistakenly include sensitive information in URL parameters. The CVSS vector indicates local access, high privileges, high attack complexity, and user interaction are required.
Are confidentiality, integrity, or availability affected?
The provided CVSS vector identifies a high confidentiality impact. It identifies no integrity or availability impact.
How can I determine whether sensitive data may already have been exposed?
Review access logs for requests containing sensitive values in URL parameters, especially for flows where users may have supplied credentials or other confidential information in the URL.