CVE-2024-12139 json
Content Spoofing via Error Handling in Multiple WSO2 Products Enables Social Engineering Attacks
published 12d ago modified 6d ago also EUVD-2024-55841
- cvss
- 4.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 11%
- public exploits
- 0
- none known
Summary
The error handling implementation fails to properly sanitize or validate user-supplied input within URL parameters under specific conditions. This allows end-users to manipulate the error messages that are displayed by the application.
By exploiting this vulnerability, malicious actors can inject arbitrary content into error messages. This enables them to perform social engineering attacks, such as phishing or credential theft, by replacing legitimate error messages with malicious content, misleading users into compromising sensitive information or taking harmful actions.
Patch / fix
- WSO2 WSO2 API Manager 3.2.1.49, 4.1.0.210, 4.2.0.148
- WSO2 WSO2 Identity Server 5.10.0.346, 5.11.0.385, 6.0.0.229
- WSO2 WSO2 Identity Server as Key Manager 5.10.0.339
Is CVE-2024-12139 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 12d ago
Exploit prediction
0.21% chance of exploitation in the next 30 days, higher than 11% of all scored CVEs (FIRST EPSS, 2026-11-14).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N |
Affected products
- WSO2 WSO2 API Manager
- WSO2 WSO2 Identity Server
- WSO2 WSO2 Identity Server as Key Manager
Classification
- Weakness
-
- CWE-116 Improper Encoding or Escaping of Output
References
Sources
- CVE List CVE-2024-12139
- NVD CVE-2024-12139
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.