CVE-2024-0392 Cross-site request forgery in WSO2 Enterprise Integrator

Medium 5.4 Published 27 Feb 2025 Updated 27 Feb 2025

Attackers can trick authenticated users into performing unauthorized state-changing actions in the WSO2 Enterprise Integrator management console.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2024-0392?

CVE-2024-0392 is a medium-severity vulnerability in WSO2 Enterprise Integrator, published on 27 Feb 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

A Cross-Site Request Forgery (CSRF) vulnerability exists in the management console of WSO2 Enterprise Integrator 6.6.0 due to the absence of CSRF token validation. This flaw allows attackers to craft malicious requests that can trigger state-changing operations on behalf of an authenticated user, potentially compromising account settings and data integrity. The vulnerability only affects a limited set of state-changing operations, and successful exploitation requires social engineering to trick a user with access to the management console into performing the malicious action.

Weakness: CWE-352

Which versions are affected by CVE-2024-0392?

It affects 1 product.

Products include Wso2 Enterprise Integrator.

How do I fix CVE-2024-0392?

No fix has been published for CVE-2024-0392 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-0392 being exploited?

There is no known exploitation of CVE-2024-0392 in the wild and no public exploit code.

Sources

Also known as GHSA-gcw3-8xrx-4mpm.