Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2024-7073

Unauthenticated Server-Side Request Forgery (SSRF) in Multiple WSO2 Products via SOAP Admin Services

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WSO2

Description

A server-side request forgery (SSRF) vulnerability exists in multiple WSO2 products due to improper input validation in SOAP admin services. This flaw allows unauthenticated attackers to manipulate server-side requests, enabling access to internal and external resources available through the network or filesystem. Exploitation of this vulnerability could lead to unauthorized access to sensitive data and systems, including resources within private networks, as long as they are reachable by the affected product.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

WSO2 WSO2 Identity Server as Key Manager

Default version status: unaffected

  • 0 to < 5.3.0unknown
  • 5.3.0 to < 5.3.0.37affected
  • 5.5.0 to < 5.5.0.50affected
  • 5.6.0 to < 5.6.0.71affected
  • 5.7.0 to < 5.7.0.122affected
  • 5.9.0 to < 5.9.0.165affected
  • 5.10.0 to < 5.10.0.312affected

WSO2 WSO2 Identity Server

Default version status: unaffected

  • 0 to < 5.2.0unknown
  • 5.2.0 to < 5.2.0.32affected
  • 5.3.0 to < 5.3.0.32affected
  • 5.4.0 to < 5.4.0.31affected
  • 5.4.1 to < 5.4.1.36affected
  • 5.5.0 to < 5.5.0.49affected
  • 5.6.0 to < 5.6.0.57affected
  • 5.7.0 to < 5.7.0.123affected
  • 5.8.0 to < 5.8.0.105affected
  • 5.9.0 to < 5.9.0.156affected
  • 5.10.0 to < 5.10.0.318affected
  • 5.11.0 to < 5.11.0.364affected
  • 6.0.0 to < 6.0.0.208affected
  • 6.1.0 to < 6.1.0.187affected
  • 7.0.0 to < 7.0.0.59affected

WSO2 WSO2 Open Banking KM

Default version status: unaffected

  • 0 to < 1.3.0unknown
  • 1.3.0 to < 1.3.0.114affected
  • 1.4.0 to < 1.4.0.130affected
  • 1.5.0 to < 1.5.0.120affected

WSO2 WSO2 Open Banking IAM

Default version status: unaffected

  • 0 to < 2.0.0unknown
  • 2.0.0 to < 2.0.0.363affected

WSO2 WSO2 Carbon Policy Editor BE

Default version status: unknown

  • 5.2.2 to < 5.2.2.14affected
  • 5.7.5 to < 5.7.5.15affected
  • 5.10.86 to < 5.10.86.5affected
  • 5.10.112 to < 5.10.112.16affected
  • 5.11.148 to < 5.11.148.15affected
  • 5.11.256 to < 5.11.256.17affected
  • 5.12.153 to < 5.12.153.59affected
  • 5.12.387 to < 5.12.387.42affected
  • 5.14.97 to < 5.14.97.76affected
  • 5.17.5 to < 5.17.5.284affected
  • 5.18.187 to < 5.18.187.268affected
  • 5.23.8 to < 5.23.8.186affected
  • 5.25.92 to < 5.25.92.95affected
  • 7.0.78 to < 7.0.78.35affected
  • 7.4.3 to ≤ *unaffected

References