Skip to content
CVE PROGRAM SOURCE RECORD9.8 Critical

CVE-2024-6914

Incorrect Authorization in Multiple WSO2 Products via Account Recovery SOAP Admin Service Leading to Account Takeover

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WSO2

Description

An incorrect authorization vulnerability exists in multiple WSO2 products due to a business logic flaw in the account recovery-related SOAP admin service. A malicious actor can exploit this vulnerability to reset the password of any user account, leading to a complete account takeover, including accounts with elevated privileges. This vulnerability is exploitable only through the account recovery SOAP admin services exposed via the "/services" context path in affected products. The impact may be reduced if access to these endpoints has been restricted based on the "Security Guidelines for Production Deployment" by disabling exposure to untrusted networks.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

WSO2 WSO2 API Manager

Default version status: unaffected

  • 0 to < 2.2.0unknown
  • 2.2.0 to < 2.2.0.55affected
  • 2.5.0 to < 2.5.0.82affected
  • 2.6.0 to < 2.6.0.141affected
  • 3.0.0 to < 3.0.0.161affected
  • 3.1.0 to < 3.1.0.292affected
  • 3.2.0 to < 3.2.0.382affected
  • 3.2.1 to < 3.2.1.14affected
  • 4.0.0 to < 4.0.0.304affected
  • 4.1.0 to < 4.1.0.164affected
  • 4.2.0 to < 4.2.0.99affected
  • 4.3.0 to < 4.3.0.15affected

WSO2 WSO2 Governance Registry

Default version status: unknown

  • 5.4.0 to < 5.4.0.14affected

WSO2 WSO2 Identity Server

Default version status: unaffected

  • 0 to < 5.3.0unknown
  • 5.3.0 to < 5.3.0.31affected
  • 5.4.0 to < 5.4.0.30affected
  • 5.4.1 to < 5.4.1.35affected
  • 5.5.0 to < 5.5.0.48affected
  • 5.6.0 to < 5.6.0.56affected
  • 5.7.0 to < 5.7.0.122affected
  • 5.8.0 to < 5.8.0.104affected
  • 5.9.0 to < 5.9.0.155affected
  • 5.10.0 to < 5.10.0.317affected
  • 5.11.0 to < 5.11.0.363affected
  • 6.0.0 to < 6.0.0.207affected
  • 6.1.0 to < 6.1.0.184affected
  • 7.0.0 to < 7.0.0.56affected

WSO2 WSO2 Identity Server as Key Manager

Default version status: unaffected

  • 0 to < 5.3.0unknown
  • 5.3.0 to < 5.3.0.36affected
  • 5.5.0 to < 5.5.0.49affected
  • 5.6.0 to < 5.6.0.70affected
  • 5.7.0 to < 5.7.0.121affected
  • 5.9.0 to < 5.9.0.162affected
  • 5.10.0 to < 5.10.0.311affected

WSO2 WSO2 IoT

Default version status: unknown

  • 3.3.0 to < 3.3.0.59affected
  • 3.3.1 to < 3.3.1.61affected

WSO2 WSO2 Open Banking AM

Default version status: unaffected

  • 0 to < 1.3.0unknown
  • 1.3.0 to < 1.3.0.130affected
  • 1.4.0 to < 1.4.0.133affected
  • 1.5.0 to < 1.5.0.135affected
  • 2.0.0 to < 2.0.0.341affected

WSO2 WSO2 Open banking KM

Default version status: unaffected

  • 0 to < 1.3.0unknown
  • 1.3.0 to < 1.3.0.113affected
  • 1.4.0 to < 1.4.0.129affected
  • 1.5.0 to < 1.5.0.119affected

WSO2 WSO2 Open Banking IAM

Default version status: unaffected

  • 2.0.0 to < 2.0.0.362affected

WSO2 WSO2 Carbon Identity Management

Default version status: unknown

  • 5.7.5 to < 5.7.5.9affected
  • 5.10.86 to < 5.10.86.4affected
  • 5.10.112 to < 5.10.112.14affected
  • 5.11.148 to < 5.11.148.13affected
  • 5.11.256 to < 5.11.256.15affected
  • 5.12.153 to < 5.12.153.58affected
  • 5.12.387 to < 5.12.387.41affected
  • 5.14.97 to < 5.14.97.75affected
  • 5.17.5 to < 5.17.5.282affected
  • 5.17.118 to < 5.17.118.4affected
  • 5.18.187 to < 5.18.187.265affected
  • 5.18.248 to < 5.18.248.14affected
  • 5.23.8 to < 5.23.8.184affected
  • 5.24.8 to < 5.24.8.6affected
  • 5.25.92 to < 5.25.92.92affected
  • 5.25.705 to < 5.25.705.6affected
  • 7.0.78 to < 7.0.78.32affected
  • 7.3.44 to ≤ *unaffected

References