Open Redirection via Callback URL in WSO2 API Manager Allows Phishing Attacks
Impact
The callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by malicious actors.
Source excerpt · WSO2What to do
Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3403/#solution
Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
WSO2 · WSO2
WSO2 API Manager
4 ranges
WSO2 · WSO2
WSO2 API Manager
Compare with this publisher’s ranges. This does not inspect your installation.
affected
4.1.0 → before 4.1.0.153
custom versions
4.2.0 → before 4.2.0.105
custom versions
4.3.0 → before 4.3.0.20
custom versions
unknown
0 → before 4.1.0
custom versions
Other versions: unaffected
Original source description
The callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by malicious actors.
Exploitation of this vulnerability could lead to users being redirected to attacker-controlled web pages. This can be used in conjunction with social engineering techniques to trick users into interacting with malicious links, potentially resulting in phishing attacks aimed at acquiring sensitive information or causing other harm.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2024-4989View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.