CVE-2024-5139: WSO2 Enterprise Integrator 6.6.0 to before 6.6.0.204; +6 more affected products

Affected technology

WSO2 Enterprise Integrator · 6.6.0 to before 6.6.0.204
WSO2

WSO2 Identity Server · 5.10.0 to before 5.10.0.310, 6.0.0 to before 6.0.0.212, 6.1.0 to before 6.1.0.195, 7.0.0 to before 7.0.0.64
WSO2

WSO2 API Manager · 3.1.0 to before 3.1.0.286, 3.2.0 to before 3.2.0.376, 3.2.1 to before 3.2.1.10, 4.0.0 to before 4.0.0.299, 4.1.0 to before 4.1.0.159, 4.2.0 to before 4.2.0.91, 4.3.0 to before 4.3.0.6
WSO2

WSO2 Open Banking AM · 2.0.0 to before 2.0.0.336
WSO2

WSO2 Identity Server as Key Manager · 5.10.0 to before 5.10.0.306
WSO2

WSO2 Open Banking IAM · 2.0.0 to before 2.0.0.357
WSO2

WSO2 Carbon User Management UI · 5.14.127 to before 5.14.127.6, 5.17.5 to before 5.17.5.273, 5.17.118 to before 5.17.118.3, 5.18.187 to before 5.18.187.260, 5.18.248 to before 5.18.248.12, 5.23.8 to before 5.23.8.191, 5.24.8 to before 5.24.8.3, 5.25.92 to before 5.25.92.99, 5.25.705 to before 5.25.705.3, 7.0.78 to before 7.0.78.43
WSO2

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · No privileges required · User interaction required

What an attacker can do

An attacker can redirect the user's browser to a malicious website, modify the web page's user interface, or extract sensitive information from the browser. Source advisory’s CVSS 3.1 assessment (base score 6.1/10) rates confidentiality and integrity impact as low; availability impact as none.