PT-2025-39178 · Wso2 · Wso2 Products

Published 2025-09-23 · Updated 2025-10-06 · CVE-2024-6429

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions WSO2 products (affected versions not specified)

Description A content spoofing issue arises from improper error message handling. Error messages are passed through URL parameters without validation, potentially allowing attackers to inject arbitrary content into the user interface. This manipulation can enable social engineering attacks by displaying deceptive or misleading content in the browser. The issue allows attackers to manipulate browser-displayed error messages.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

UI Misrepresentation of Critical Information

Weakness Enumeration

CWE-451

Related Identifiers

CVE-2024-6429

GHSA-R6F3-55WJ-G9P3

Affected Products

Wso2 Products

References · 11

• https://osv.dev/vulnerability/GHSA-r6f3-55wj-g9p3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-6429 · Security Note
• https://osv.dev/vulnerability/CVE-2024-6429 · Vendor Advisory
• https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2024-3490 · Vendor Advisory
• https://github.com/wso2/identity-apps/releases/tag/@wso2is/identity-apps-core@2.4.4 · Note
• https://github.com/wso2/identity-apps/pull/6488 · Note
• https://github.com/wso2/identity-apps/commit/75babf6b60f940f86bada7020e5d464ca95e47f2 · Note
• https://github.com/wso2/identity-apps · Note
• https://t.me/cveNotify/137492 · Telegram Post
• https://twitter.com/CVEnew/status/1970621804135002291 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1970641700306448418 · Twitter Post