CVE-2024-4412: WSO2 Enterprise Integrator 6.6.0 to before 6.6.0.205; +10 more affected products

Affected technology

WSO2 Enterprise Integrator · 6.6.0 to before 6.6.0.205
WSO2

WSO2 API Manager · 3.1.0 to before 3.1.0.276, 3.2.0 to before 3.2.0.366, 3.2.1 to before 3.2.1.18, 4.0.0 to before 4.0.0.307, 4.1.0 to before 4.1.0.169, 4.2.0 to before 4.2.0.108, 4.3.0 to before 4.3.0.20
WSO2

WSO2 Open Banking IAM · 2.0.0 to before 2.0.0.346
WSO2

WSO2 Identity Server · 5.10.0 to before 5.10.0.297, 5.11.0 to before 5.11.0.337, 6.0.0 to before 6.0.0.189, 6.1.0 to before 6.1.0.149, 7.0.0 to before 7.0.0.15
WSO2

WSO2 Identity Server as Key Manager · 5.10.0 to before 5.10.0.293
WSO2

WSO2 Open Banking AM · 2.0.0 to before 2.0.0.326
WSO2

WSO2 Carbon Identity User Store Configuration UI · 5.14.127 to before 5.14.127.8, 5.17.5 to before 5.17.5.266, 5.17.118 to before 5.17.118.6, 5.18.187 to before 5.18.187.253, 5.18.248 to before 5.18.248.20, 5.23.8 to before 5.23.8.178, 5.24.8 to before 5.24.8.9, 5.25.92 to before 5.25.92.81, 5.25.705 to before 5.25.705.8, 7.0.78 to before 7.0.78.12
WSO2

WSO2 Carbon Identity User Store Configuration · 5.14.127 to before 5.14.127.8, 5.17.5 to before 5.17.5.266, 5.17.118 to before 5.17.118.6, 5.18.187 to before 5.18.187.253, 5.18.248 to before 5.18.248.20, 5.23.8 to before 5.23.8.178, 5.24.8 to before 5.24.8.9, 5.25.92 to before 5.25.92.81, 5.25.705 to before 5.25.705.8, 7.0.78 to before 7.0.78.12
WSO2

WSO2 Carbon Identity Recovery Management · 1.4.72 to before 1.4.72.66, 1.4.100 to before 1.4.100.6, 1.7.2 to before 1.7.2.2, 1.8.107 to before 1.8.107.1
WSO2

WSO2 Carbon Identity Application Authentication Framework · 5.18.248 to before 5.18.248.20, 5.24.8 to before 5.24.8.9, 5.25.705 to before 5.25.705.8
WSO2

WSO2 Carbon Identity User Store · 1.0.190 to before 1.0.190.14, 1.2.3 to before 1.2.3.4, 1.2.23 to before 1.2.23.4
WSO2

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · High privileges required · No user interaction required

What an attacker can do

Source advisory’s CVSS 3.1 assessment (base score 2.7/10) rates confidentiality impact as low; integrity and availability impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.