Improper input validation in Wso2 Api Control Plane
CVE-2024-10302
The user self-signup flow in multiple WSO2 products fails to adequately validate user-supplied input. This weakness allows arbitrary unvalidated data to be included within user claims, which are then used by downstream processes. Allowing…
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
CVSS v3 metric
CVSS v3 base score 4.0 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N.
Affected products
- Wso2 Api Control Plane — versions 4.5.0
- Wso2 Api Manager — versions 0, 3.1.0, 3.2.0
- Wso2 Carbon Identity Recovery Management — versions 1.4.1, 1.4.72, 1.4.100
- Wso2 Identity Server — versions 0, 5.10.0, 5.11.0
- Wso2 Identity Server As Key Manager — versions 0, 5.10.0
- Wso2 Open Banking Iam — versions 0, 2.0.0
- Wso2 Traffic Manager — versions 4.5.0
- Wso2 Universal Gateway — versions 4.5.0
Weakness classification (CWE)
References
- ed10eef1-636d-4fbe-9993-6890dfa878f8 (vendor-advisory)
Frequently asked questions
- What is CVE-2024-10302?
- CVE-2024-10302 is a medium-severity vulnerability in Wso2 Api Control Plane, classified under Improper Input Validation. CVSS score: 4.0/10. Published 2026-08-06.
- How severe is CVE-2024-10302?
- Medium severity. CVSS v3 base score is 4.0 out of 10.