CVE-2024-10242
MEDIUM EPSS 14.9%
Published Apr 16, 20262mo ago · Modified Jun 17, 20261w ago
6.1 CVSS 3.1
Published Apr 16, 2026 2mo ago
Last Modified Jun 17, 2026 1w ago
Description
The authentication endpoint fails to adequately validate user-supplied input before reflecting it back in the response. This allows an attacker to inject malicious script payloads into the input parameters, which are then executed by the victim's browser. Successful exploitation can enable an attacker to redirect the user's browser to a malicious website, modify the UI of the web page, or retrieve information from the browser. However, the impact is limited as session-related sensitive cookies are protected by the httpOnly flag, preventing session hijacking.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Changed
Confidentiality Low
Integrity Low
Availability None
Threat Intelligence
EPSS Exploit Probability
14.9% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-79 Cross-site Scripting Injection
Affected Products 2
References 1
- security.docs.wso2.com https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3741/
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.