Read the docs
TI-2024-00357 Aliases CVE-2024-0392GHSA-gcw3-8xrx-4mpm

Cross-site request forgery in WSO2 Enterprise Integrator

Priority LOW 23CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
None · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-352.

Summary

A Cross-Site Request Forgery (CSRF) vulnerability exists in the management console of WSO2 Enterprise Integrator 6.6.0 due to the absence of CSRF token validation. This flaw allows attackers to craft malicious requests that can trigger state-changing operations on behalf of an authenticated user, potentially compromising account settings and data integrity. The vulnerability only affects a limited set of state-changing operations, and successful exploitation requires social engineering to trick a user with access to the management console into performing the malicious action.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00146 3rd percentileScored 2026-11-07
Fix Fixed WSO2 Enterprise Integrator (WSO2): 6.6.0.179

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WSO2WSO2 Enterprise Integrator6.6.0 to before 6.6.0.1796.6.0.179Patch availableCNA
  • WSO2 Enterprise Integrator VendorWSO2 Affected 6.6.0 to before 6.6.0.179 Fixed in 6.6.0.179 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:wso2:enterprise_integrator:6.6.0:*:*:*:*:*:*:*6.6.0VulnerableWSO2
  • cpe:2.3:a:wso2:enterprise_integrator:6.6.0:*:*:*:*:*:*:* Versions 6.6.0 Vulnerable ·WSO2

Remediation

  • Fix · CNA WSO2 Enterprise Integrator (WSO2) Fixed in 6.6.0.179

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-0392
  2. 2026-10-03 Alias added: GHSA-gcw3-8xrx-4mpm

References

Advisory 1

  • TI-2022-11928 Certain WSO2 products allow unrestricted file upload with resultant remote code execution. KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-18808 An issue was discovered in WSO2 Enterprise Integrator 6.4.0. CVSS 3.1MEDIUM 6.1
  • TI-2022-12002 A reflected XSS issue exists in the Management Console of several WSO2 products. CVSS 3.1MEDIUM 6.1
  • TI-2020-13218 WSO2 Management Console through 5.10 allows XSS via the carbon/admin/login.jsp msgId parameter. CVSS 3.1MEDIUM 6.1
  • TI-2025-08993 Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs CVSS 3.1CRITICAL 9.6
  • TI-2025-09807 XML External Entity (XXE) Vulnerability in Multiple WSO2 Products Due to Improper XML Parser Configuration CVSS 3.1CRITICAL 9.1
See all 32 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences