Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.4

WSO2 Enterprise Integrator Console Allows Unauthorized Actions

CVE-2024-0392 · published 1 year ago
Summary

WSO2 Enterprise Integrator's management console has a weakness that lets attackers trick users into making changes to the system. This could result in unauthorized account settings changes and data corruption. Update to the latest version to fix this issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
wso2 enterprise_integrator 6.6.0
cpe:2.3:a:wso2:enterprise_integrator:6.6.0:*:*:*:*:*:*:*
Original advisory text
A Cross-Site Request Forgery (CSRF) vulnerability exists in the management console of WSO2 Enterprise Integrator 6.6.0 due to the absence of CSRF token validation. This flaw allows attackers to cra...
A Cross-Site Request Forgery (CSRF) vulnerability exists in the management console of WSO2 Enterprise Integrator 6.6.0 due to the absence of CSRF token validation. This flaw allows attackers to craft malicious requests that can trigger state-changing operations on behalf of an authenticated user, potentially compromising account settings and data integrity. The vulnerability only affects a limited set of state-changing operations, and successful exploitation requires social engineering to trick a user with access to the management console into performing the malicious action.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
5.4 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-352Cross-Site Request Forgery (CSRF)
Timeline
Published27 Feb 2025
Updated26 Oct 2026
First seen7 Mar 2026
Sources
CVE-2024-0392 · NVD
Track software like this
Free during beta