CVE-2024-6429
Content Spoofing in Multiple WSO2 Products via Error Message Injection
A content spoofing vulnerability exists in multiple WSO2 products due to improper error message handling. Under certain conditions, error messages are passed through URL parameters without validation, allowing malicious actors to inject arbitrary content into the UI.
By exploiting this vulnerability, attackers can manipulate browser-displayed error messages, enabling social engineering attacks through deceptive or misleading content.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Content Spoofing in Multiple WSO2 Products via Error Message Injection
A content spoofing vulnerability exists in multiple WSO2 products due to improper error message handling. Under certain conditions, error messages are passed through URL parameters without validation, allowing malicious actors to inject arbitrary content into the UI.
By exploiting this vulnerability, attackers can manipulate browser-displayed error messages, enabling social engineering attacks through deceptive or misleading content.
- Record
CVE-2024-6429- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-451
- Updated
- 2026-11-02
EUVDEUVD-2024-55023
A content spoofing vulnerability exists in multiple WSO2 products due to improper error message handling. Under certain conditions, error messages are passed through URL parameters without validation, allowing malicious actors to inject arbitrary content into the UI.
By exploiting this vulnerability, attackers can manipulate browser-displayed error messages, enabling social engineering attacks through deceptive or misleading content.
- Record
EUVD-2024-55023- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-r6f3-55wj-g9p3
WSO2 Identity Server Apps allows content spoofing in logs
A content spoofing issue exists in WSO2 Identity Server Apps, specifically in the Authentication Portal, due to improper handling of authentication error messages. When an authentication failure occurs, the portal previously accepted an authFailureMsg value supplied via URL and rendered it in the UI without validating it against the resource bundle. An attacker can craft a link that causes the portal to display attacker-controlled text in the error banner, enabling UI misrepresentation and social-engineering.
The fix validates the message key against the resource bundle and encodes input before rendering. Upgrade to org.wso2.identity.apps:authentication-portal 2.4.4 or later to remediate.
- Record
GHSA-r6f3-55wj-g9p3- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-451
- Updated
- 2026-11-02
NVD
A content spoofing vulnerability exists in multiple WSO2 products due to improper error message handling. Under certain conditions, error messages are passed through URL parameters without validation, allowing malicious actors to inject arbitrary content into the UI.
By exploiting this vulnerability, attackers can manipulate browser-displayed error messages, enabling social engineering attacks through deceptive or misleading content.
- Record
CVE-2024-6429- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-451
- Updated
- 2026-11-02
OSV
A content spoofing vulnerability exists in multiple WSO2 products due to improper error message handling. Under certain conditions, error messages are passed through URL parameters without validation, allowing malicious actors to inject arbitrary content into the UI.
By exploiting this vulnerability, attackers can manipulate browser-displayed error messages, enabling social engineering attacks through deceptive or misleading content.
- Record
CVE-2024-6429- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-r6f3-55wj-g9p3
WSO2 Identity Server Apps allows content spoofing in logs
A content spoofing issue exists in WSO2 Identity Server Apps, specifically in the Authentication Portal, due to improper handling of authentication error messages. When an authentication failure occurs, the portal previously accepted an authFailureMsg value supplied via URL and rendered it in the UI without validating it against the resource bundle. An attacker can craft a link that causes the portal to display attacker-controlled text in the error banner, enabling UI misrepresentation and social-engineering.
The fix validates the message key against the resource bundle and encodes input before rendering. Upgrade to org.wso2.identity.apps:authentication-portal 2.4.4 or later to remediate.
- Record
GHSA-r6f3-55wj-g9p3- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-451
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.wso2.identity.apps:authentication-portalMaven |
before 2.4.4 | 2.4.4 |
org.wso2.identity.apps:authentication-portalMaven |
before 2.4.4, plus listed versions 0.1.1250.1.1260.1.1270.1.1280.1.129 Show 45 moreShow less0.1.1300.1.1310.1.1320.1.1330.1.1340.1.1350.1.1360.1.1370.1.1380.1.1390.1.1400.1.1410.1.1420.1.1430.1.1440.1.1460.1.1470.1.1480.1.1490.1.1500.1.1510.1.1520.1.1530.1.1540.1.1550.1.1560.1.1570.1.1580.1.1590.1.1600.1.1610.1.1620.1.1631.0.11.0.101.0.1001.0.1011.0.1021.0.1031.0.1041.0.1051.0.1061.0.1071.0.1081.0.109 |
2.4.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-6429 is a medium vulnerability (CVSS 4.3) in Wso2 Api Manager, published September 23, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 11th percentile. Fixed in org.wso2.identity.apps:authentication-portal 2.4.4.
References
security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2024-3490
nvd.nist.gov/vuln/detail/CVE-2024-6429
github.com/wso2/identity-apps/pull/6488
Left out here: 2,150 versions. The JSON record has them.