{"id":"CVE-2024-2372","aliases":["EUVD-2024-55835","GHSA-9vv9-3fcf-65rq"],"status":"published","title":"Open Redirection via Unsanitized User Input in Multiple WSO2 Products Allows Phishing Attacks","description":"The affected components accept user-supplied input for constructing redirection URLs without enforcing expected validation constraints. This allows an attacker to provide a crafted URL that can redirect users to an arbitrary external domain.\n\nBy leveraging this open redirection vulnerability, an attacker can craft a malicious link that, when clicked by a user, redirects them to an attacker-controlled page. This can be used in conjunction with social engineering techniques to execute phishing attacks, aiming to obtain sensitive information or cause other harm.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00198,"percentile":0.09607,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-601"],"published":"2026-11-02T11:00:23Z","modified":"2026-11-09T10:10:00Z","products":[{"vendor":"wso2","product":"wso2 api manager"},{"vendor":"wso2","product":"wso2 carbon registry kernel"},{"vendor":"wso2","product":"wso2 enterprise integrator"},{"vendor":"wso2","product":"wso2 identity server"},{"vendor":"wso2","product":"wso2 identity server as key manager"},{"vendor":"wso2","product":"wso2 open banking am"},{"vendor":"wso2","product":"wso2 open banking iam"}],"references":[{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3254/","tags":["vendor-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-2372"},{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3254"},{"url":"https://github.com/advisories/GHSA-9vv9-3fcf-65rq"}],"sources":{"cve":[{"id":"CVE-2024-2372","title":"Open Redirection via Unsanitized User Input in Multiple WSO2 Products Allows Phishing Attacks","description":"The affected components accept user-supplied input for constructing redirection URLs without enforcing expected validation constraints. This allows an attacker to provide a crafted URL that can redirect users to an arbitrary external domain.\n\nBy leveraging this open redirection vulnerability, an attacker can craft a malicious link that, when clicked by a user, redirects them to an attacker-controlled page. This can be used in conjunction with social engineering techniques to execute phishing attacks, aiming to obtain sensitive information or cause other harm.","status":"published","published":"2026-11-02T11:00:23.105Z","modified":"2026-11-02T16:57:01.3Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T18:00:08.034842Z"}],"euvd":[{"id":"EUVD-2024-55835","description":"The affected components accept user-supplied input for constructing redirection URLs without enforcing expected validation constraints. This allows an attacker to provide a crafted URL that can redirect users to an arbitrary external domain.\n\nBy leveraging this open redirection vulnerability, an attacker can craft a malicious link that, when clicked by a user, redirects them to an attacker-controlled page. This can be used in conjunction with social engineering techniques to execute phishing attacks, aiming to obtain sensitive information or cause other harm.","status":"published","published":"2026-11-02T11:00:23Z","modified":"2026-11-02T16:57:01Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T05:08:39.764975Z"}],"ghsa":[{"id":"GHSA-9vv9-3fcf-65rq","title":"The affected components accept user-supplied input for constructing redirection URLs without...","description":"The affected components accept user-supplied input for constructing redirection URLs without enforcing expected validation constraints. This allows an attacker to provide a crafted URL that can redirect users to an arbitrary external domain.\n\nBy leveraging this open redirection vulnerability, an attacker can craft a malicious link that, when clicked by a user, redirects them to an attacker-controlled page. This can be used in conjunction with social engineering techniques to execute phishing attacks, aiming to obtain sensitive information or cause other harm.","status":"published","published":"2026-11-02T12:30:21Z","modified":"2026-11-02T12:30:25Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T15:14:55.927217Z"}],"nvd":[{"id":"CVE-2024-2372","description":"The affected components accept user-supplied input for constructing redirection URLs without enforcing expected validation constraints. This allows an attacker to provide a crafted URL that can redirect users to an arbitrary external domain.\n\nBy leveraging this open redirection vulnerability, an attacker can craft a malicious link that, when clicked by a user, redirects them to an attacker-controlled page. This can be used in conjunction with social engineering techniques to execute phishing attacks, aiming to obtain sensitive information or cause other harm.","status":"published","published":"2026-11-02T11:17:28.46Z","modified":"2026-11-09T10:10:00.217Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-601"],"updated_at":"2026-11-09T12:13:57.435619Z"}]}}