CVE-2024-6541 - Information Disclosure and Integrity Violation via Improper Message Context Handling in Multiple WSO2 Products

Back Back to CVE browser

MEDIUM

Information Disclosure and Integrity Violation via Improper Message Context Handling in Multiple WSO2 Products

Published Aug 6, 2026

6.8

MEDIUM

CVSS 3.1

EPSS 0.34%

Description

The Class Mediator fails to correctly validate or sanitize `messageContext` properties when they are used to populate dynamic values. This allows authenticated users to potentially access or modify data across different system invocations that should be isolated.

This weakness can lead to the disclosure of sensitive information belonging to other users or the unintended modification of system data by authenticated users. The exact impact depends on how `messageContext` properties are utilized within the affected WSO2 products.

Affected products

Vendor WSO2 Product WSO2 API Manager Default
unaffected
- Version
  3.2.0
  Status
  affected
  Constraints
  <3.2.0.394
- Version
  3.2.1
  Status
  affected
  Constraints
  <3.2.1.21
- Version
  4.0.0
  Status
  affected
  Constraints
  <4.0.0.311
- Version
  4.1.0
  Status
  affected
  Constraints
  <4.1.0.167
- Version
  4.2.0
  Status
  affected
  Constraints
  <4.2.0.110
- Version
  4.3.0
  Status
  affected
  Constraints
  <4.3.0.24
Vendor WSO2 Product WSO2 Enterprise Integrator Default
unaffected
- Version
  6.6.0
  Status
  affected
  Constraints
  <6.6.0.205
Vendor WSO2 Product WSO2 Micro Integrator Default
unaffected
- Version
  1.2.0
  Status
  affected
  Constraints
  <1.2.0.163
- Version
  4.1.0
  Status
  affected
  Constraints
  <4.1.0.103
- Version
  4.3.0
  Status
  affected
  Constraints
  <4.3.0.7
Vendor WSO2 Product WSO2-Synapse Default
n/a
- Version
  2.1.7.wso2v143
  Status
  affected
  Constraints
  <2.1.7.wso2v143_119
- Version
  2.1.7.wso2v182
  Status
  affected
  Constraints
  <2.1.7.wso2v182_93
- Version
  2.1.7.wso2v183
  Status
  affected
  Constraints
  <2.1.7.wso2v183_62
- Version
  2.1.7.wso2v227
  Status
  affected
  Constraints
  <2.1.7.wso2v227_88
- Version
  2.1.7.wso2v271
  Status
  affected
  Constraints
  <2.1.7.wso2v271_60
- Version
  2.1.7.wso2v319
  Status
  affected
  Constraints
  <2.1.7.wso2v319_7
- Version
  4.0.0.wso2v105
  Status
  affected
  Constraints
  <4.0.0.wso2v105_3
- Version
  4.0.0.wso2v119
  Status
  affected
  Constraints
  <4.0.0.wso2v119_3
- Version
  4.0.0.wso2v20
  Status
  affected
  Constraints
  <4.0.0.wso2v20_63
- Version
  v4.0.0-wso2v121
  Status
  unaffected
  Constraints
  <=v4.0.0-wso2v*

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

WSO2

WSO2 API Manager

unaffected

Version	Status	Constraints
3.2.0	affected	<3.2.0.394
3.2.1	affected	<3.2.1.21
4.0.0	affected	<4.0.0.311
4.1.0	affected	<4.1.0.167
4.2.0	affected	<4.2.0.110
4.3.0	affected	<4.3.0.24

WSO2

WSO2 Enterprise Integrator

unaffected

Version	Status	Constraints
6.6.0	affected	<6.6.0.205

WSO2

WSO2 Micro Integrator

unaffected

Version	Status	Constraints
1.2.0	affected	<1.2.0.163
4.1.0	affected	<4.1.0.103
4.3.0	affected	<4.3.0.7

WSO2

WSO2-Synapse

n/a

Version	Status	Constraints
2.1.7.wso2v143	affected	<2.1.7.wso2v143_119
2.1.7.wso2v182	affected	<2.1.7.wso2v182_93
2.1.7.wso2v183	affected	<2.1.7.wso2v183_62
2.1.7.wso2v227	affected	<2.1.7.wso2v227_88
2.1.7.wso2v271	affected	<2.1.7.wso2v271_60
2.1.7.wso2v319	affected	<2.1.7.wso2v319_7
4.0.0.wso2v105	affected	<4.0.0.wso2v105_3
4.0.0.wso2v119	affected	<4.0.0.wso2v119_3
4.0.0.wso2v20	affected	<4.0.0.wso2v20_63
v4.0.0-wso2v121	unaffected	<=v4.0.0-wso2v*

Remediation

Vendor solution

Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3520/#solution https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3520/#solution

Weaknesses (1)

CWE-20

Improper Input Validation

References (2)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-55712		Advisory
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3520/		vendor-advisory