A content spoofing vulnerability exists in multiple WSO2 products due to improper error message handling. Under certain conditions, error messages are passed through URL parameters without validation, allowing malicious actors to inject arbitrary content into the UI.
By exploiting this vulnerability, attackers can manipulate browser-displayed error messages, enabling social engineering attacks through deceptive or misleading content.
References
| Link | Resource |
|---|---|
| https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2024-3490/ | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
06 Oct 2025, 13:39
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Wso2 api Manager
Wso2 identity Server Wso2 |
|
| References | () https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2024-3490/ - Vendor Advisory | |
| CPE | cpe:2.3:a:wso2:api_manager:4.4.0:-:*:*:*:*:*:* cpe:2.3:a:wso2:identity_server:6.1.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:identity_server:6.0.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:api_manager:4.0.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:api_manager:4.1.0:-:*:*:*:*:*:* cpe:2.3:a:wso2:api_manager:4.3.0:-:*:*:*:*:*:* cpe:2.3:a:wso2:identity_server:5.11.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:api_manager:3.2.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:api_manager:4.2.0:-:*:*:*:*:*:* cpe:2.3:a:wso2:identity_server:7.0.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:api_manager:3.2.1:*:*:*:*:*:*:* cpe:2.3:a:wso2:identity_server:5.10.0:*:*:*:*:*:*:* |
25 Sep 2025, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-451 |
23 Sep 2025, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-09-23 17:15
Updated : 2025-10-06 13:39
NVD link : CVE-2024-6429
Mitre link : CVE-2024-6429
CVE.ORG link : CVE-2024-6429
JSON object : View
Products Affected
wso2
- identity_server
- api_manager
CWE
CWE-451
User Interface (UI) Misrepresentation of Critical Information