Medium severity · published Sep 23, 2025
CVE-2024-4598
An information disclosure vulnerability exists in multiple WSO2 products due to improper implementation of the enrich mediator
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
An information disclosure vulnerability exists in multiple WSO2 products due to improper implementation of the enrich mediator. Authenticated users may be able to view unintended business data from other mediation contexts because the internal state is not properly isolated or cleared between executions. This vulnerability does not impact user credentials or access tokens but may lead to leakage of sensitive business information handled during message flows.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AM
Api Manager · Wso2
3.2.0 before 3.2.0.422; 3.2.1 before 3.2.1.42; 4.1.0 before 4.1.0.152; 4.3.0 before 4.3.0.55 · source: NVD
MI
Micro Integrator · Wso2
1.2.0 before 1.2.0.157; 4.1.0 before 4.1.0.95 · source: NVD
Affected product
AM
Api Manager
Wso2
More from Api Manager
10.0
CVE-2026-5430
Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover
9.8
CVE-2022-29464
WSO2 Multiple Products Unrestrictive Upload of File Vulnerability
10.0
CVE-2026-2053
Unauthenticated Server-Side Request Forgery via WS-Addressing in WSO2 API Manager
9.8
CVE-2026-1728
Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover
9.8
CVE-2025-9312
Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products