CVE-2024-4598

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An information disclosure vulnerability exists in multiple WSO2 products due to improper implementation of the enrich mediator. Authenticated users may be able to view unintended business data from other mediation contexts because the internal state is not properly isolated or cleared between executions.

This vulnerability does not impact user credentials or access tokens but may lead to leakage of sensitive business information handled during message flows.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-1259

Affected software

No affected versions have been published.

Timeline

Published: Sep 23, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-459808.8A host header injection vulnerability in MEANStore 1.0 allows attackers to obtain the password reset token via user interaction with a craft CVE-2024-459818.8A host header injection vulnerability in BookReviewLibrary 1.0 allows attackers to obtain the password reset token via user interaction with CVE-2024-459828.8A host header injection vulnerability in scheduleR v0.0.18 allows attackers to obtain the password reset token via user interaction with a c CVE-2024-459836.3A Cross-Site Request Forgery (CSRF) vulnerability exists in kishan0725's Hospital Management System version 6.3.5. The vulnerability allows CVE-2024-459844.7A Cross Site Scripting (XSS) vulnerability in add_donor.php of Blood Bank And Donation Management System 1.0 allows an attacker to inject ma CVE-2024-459854.7A Cross Site Scripting (XSS) vulnerability in update_contact.php of Blood Bank and Donation Management System v1.0 allows an attacker to inj CVE-2024-459865.4A stored Cross-Site Scripting (XSS) vulnerability was identified in Projectworld Online Voting System 1.0 that occurs when an account is reg CVE-2024-459876.5Projectworld Online Voting System Version 1.0 is vulnerable to Cross Site Request Forgery (CSRF) via voter.php. This vulnerability allows an CVE-2024-459894.0Monica AI Assistant desktop application v2.3.0 is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor. A prompt injecti CVE-2024-45997.5Remote denial of service vulnerability in LAN Messenger affecting version 3.4.0. This vulnerability allows an attacker to crash the LAN Mess CVE-2024-459936.5Giflib Project v5.2.2 is vulnerable to a heap buffer overflow via gif2rgb.CVE-2024-459999.8A SQL Injection vulnerability was discovered in Cloudlog 2.6.15, specifically within the get_station_info()function located in the file /app