CVE-2024-7096
Privilege Escalation in Multiple WSO2 Products via SOAP Admin Service Due to Business Logic Flaw
MEDIUM 4.2
At a glance
- Source
- NVD
- EPSS
- EPSS 0.74 % · percentile 54 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- WSO2
- NVD status
- Modified
Description
A privilege escalation vulnerability exists in multiple WSO2 products due to a business logic flaw in SOAP admin services. A malicious actor can create a new user with elevated permissions only when all of the following conditions are met: * SOAP admin services are accessible to the attacker. * The deployment includes an internally used attribute that is not part of the default WSO2 product configuration. * At least one custom role exists with non-default permissions. * The attacker has knowledge of the custom role and the internal attribute used in the deployment. Exploiting this vulnerability allows malicious actors to assign higher privileges to self-registered users, bypassing intended access control mechanisms.
Weaknesses (CWE)
- CWE-863 — Incorrect Authorization
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 4.2 | CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N | WSO2 |
| CVSS 3.1 | MEDIUM 4.2 | CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N | NVD · ed10eef1-636d-4fbe-9993-6890dfa878f8 (Secondary) |
| CVSS 3.1 | MEDIUM 5.4 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-j63j-7r7r-5v4j — WSO2 products vulnerable to privilege escalation due to business logic flaw in SOAP admin services
European references
- ENISA EUVD · EUVD-2024-54612
- GCVE · GCVE-0-2024-7096
Affected configurations (NVD CPE)
cpe:2.3:a:wso2:api_manager:2.0.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:api_manager:2.1.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:api_manager:2.2.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:api_manager:2.5.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:api_manager:2.6.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:api_manager:3.0.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:api_manager:3.1.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:api_manager:3.2.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:api_manager:3.2.1:*:*:*:*:*:*:*cpe:2.3:a:wso2:api_manager:4.0.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:api_manager:4.1.0:-:*:*:*:*:*:*cpe:2.3:a:wso2:api_manager:4.2.0:-:*:*:*:*:*:*cpe:2.3:a:wso2:api_manager:4.3.0:-:*:*:*:*:*:*cpe:2.3:a:wso2:identity_server:5.2.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:identity_server:5.3.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:identity_server:5.4.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:identity_server:5.4.1:*:*:*:*:*:*:*cpe:2.3:a:wso2:identity_server:5.5.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:identity_server:5.6.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:identity_server:5.7.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:identity_server:5.8.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:identity_server:5.9.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:identity_server:5.10.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:identity_server:5.11.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:identity_server:6.0.0:-:*:*:*:*:*:*cpe:2.3:a:wso2:identity_server:6.1.0:-:*:*:*:*:*:*cpe:2.3:a:wso2:identity_server:7.0.0:-:*:*:*:*:*:*cpe:2.3:a:wso2:identity_server_as_key_manager:5.3.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:identity_server_as_key_manager:5.5.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:identity_server_as_key_manager:5.6.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:identity_server_as_key_manager:5.7.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:identity_server_as_key_manager:5.9.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:identity_server_as_key_manager:5.10.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:open_banking_am:1.3.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:open_banking_am:1.4.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:open_banking_am:1.5.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:open_banking_am:2.0.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:open_banking_iam:2.0.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:open_banking_km:1.3.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:open_banking_km:1.4.0:*:*:*:*:*:*:*- +1 more
Affected products
| Product | Versions |
|---|---|
| WSO2 · WSO2 Open Banking IAM | unknown 0 < 2.0.0 ; affected 2.0.0 < 2.0.0.364 |
| WSO2 · WSO2 Open Banking AM | unknown 0 < 1.3.0 ; affected 1.3.0 < 1.3.0.131 ; affected 1.4.0 < 1.4.0.134 ; affected 1.5.0 < 1.5.0.136 ; affected 2.0.0 < 2.0.0.343 |
| WSO2 · WSO2 API Manager | unknown 0 < 2.0.0 ; affected 2.0.0 < 2.0.0.29 ; affected 2.1.0 < 2.1.0.39 ; affected 2.2.0 < 2.2.0.56 ; affected 2.5.0 < 2.5.0.83 ; affected 2.6.0 < 2.6.0.142 |
| WSO2 · WSO2 Enterprise Mobility Manager | affected 2.2.0 < 2.2.0.26 |
| WSO2 · WSO2 Identity Server | unknown 0 < 5.2.0 ; affected 5.2.0 < 5.2.0.32 ; affected 5.3.0 < 5.3.0.33 ; affected 5.4.1 < 5.4.1.36 ; affected 5.5.0 < 5.5.0.50 ; affected 5.6.0 < 5.6.0.58 |
| WSO2 · WSO2 Identity Server as Key Manager | unknown 0 < 5.3.0 ; affected 5.3.0 < 5.3.0.38 ; affected 5.5.0 < 5.5.0.51 ; affected 5.6.0 < 5.6.0.72 ; affected 5.7.0 < 5.7.0.122 ; affected 5.9.0 < 5.9.0.165 |
| WSO2 · WSO2 Open Banking KM | unknown 0 < 1.3.0 ; affected 1.3.0 < 1.3.0.114 ; affected 1.4.0 < 1.4.0.130 ; affected 1.5.0 < 1.5.0.120 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |