CVE-2024-4989
Open Redirection via Callback URL in WSO2 API Manager Allows Phishing Attacks
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 4.1.0.153, 4.2.0.105, 4.3.0.20
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by malicious actors. Exploitation of this vulnerability could lead to users being redirected to attacker-controlled web pages. This can be used in conjunction with social engineering techniques to trick users into interacting with malicious links, potentially resulting in phishing attacks aimed at acquiring sensitive information or causing other harm.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- WSO2 WSO2 API Manager
From 4.1.0 · fixed in 4.1.0.153; From 4.2.0 · fixed in 4.2.0.105; From 4.3.0 · fixed in 4.3.0.20