CVE-2024-0392

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-0392
A Cross-Site Request Forgery (CSRF) vulnerability exists in the management console of WSO2 Enterprise Integrator 6.6.0 due to the absence of CSRF token validation. This flaw allows attackers to craft malicious requests that can trigger state-changing operations on behalf of an authenticated user, potentially compromising account settings and data integrity. The vulnerability only affects a limited set of state-changing operations, and successful exploitation requires social engineering to trick a user with access to the management console into performing the malicious action.

5.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2023-2987/ Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:wso2:enterprise_integrator:6.6.0:*:*:*:*:*:*:*
History

06 Oct 2025, 13:55

Type Values Removed Values Added
CPE cpe:2.3:a:wso2:enterprise_integrator:6.6.0:*:*:*:*:*:*:*
Summary
  • (es) Existe una vulnerabilidad de Cross-Site Request Forgery (CSRF) en la consola de administración de WSO2 Enterprise Integrator 6.6.0 debido a la ausencia de validación de token CSRF. Este fallo permite a los atacantes crear solicitudes maliciosas que pueden activar operaciones de cambio de estado en nombre de un usuario autenticado, lo que podría comprometer la configuración de la cuenta y la integridad de los datos. La vulnerabilidad solo afecta a un conjunto limitado de operaciones de cambio de estado y, para explotarla con éxito, se requiere ingeniería social para engañar a un usuario con acceso a la consola de administración para que realice la acción maliciosa.
References () https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2023-2987/ - () https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2023-2987/ - Vendor Advisory
First Time Wso2 enterprise Integrator
Wso2

27 Feb 2025, 07:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-27 07:15

Updated : 2025-10-06 13:55

NVD link : CVE-2024-0392

Mitre link : CVE-2024-0392

CVE.ORG link : CVE-2024-0392

JSON object : View

Products Affected

wso2

  • enterprise_integrator
CWE
CWE-352

Cross-Site Request Forgery (CSRF)