Skip to content
CVE PROGRAM SOURCE RECORD4.2 Medium

CVE-2024-7096

Privilege Escalation in Multiple WSO2 Products via SOAP Admin Service Due to Business Logic Flaw

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WSO2

Description

A privilege escalation vulnerability exists in multiple WSO2 products due to a business logic flaw in SOAP admin services. A malicious actor can create a new user with elevated permissions only when all of the following conditions are met: * SOAP admin services are accessible to the attacker. * The deployment includes an internally used attribute that is not part of the default WSO2 product configuration. * At least one custom role exists with non-default permissions. * The attacker has knowledge of the custom role and the internal attribute used in the deployment. Exploiting this vulnerability allows malicious actors to assign higher privileges to self-registered users, bypassing intended access control mechanisms.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

WSO2 WSO2 Open Banking IAM

Default version status: unaffected

  • 0 to < 2.0.0unknown
  • 2.0.0 to < 2.0.0.364affected

WSO2 WSO2 Open Banking AM

Default version status: unaffected

  • 0 to < 1.3.0unknown
  • 1.3.0 to < 1.3.0.131affected
  • 1.4.0 to < 1.4.0.134affected
  • 1.5.0 to < 1.5.0.136affected
  • 2.0.0 to < 2.0.0.343affected

WSO2 WSO2 API Manager

Default version status: unaffected

  • 0 to < 2.0.0unknown
  • 2.0.0 to < 2.0.0.29affected
  • 2.1.0 to < 2.1.0.39affected
  • 2.2.0 to < 2.2.0.56affected
  • 2.5.0 to < 2.5.0.83affected
  • 2.6.0 to < 2.6.0.142affected
  • 3.0.0 to < 3.0.0.162affected
  • 3.1.0 to < 3.1.0.294affected
  • 3.2.0 to < 3.2.0.384affected
  • 3.2.1 to < 3.2.1.16affected
  • 4.0.0 to < 4.0.0.305affected
  • 4.1.0 to < 4.1.0.166affected
  • 4.2.0 to < 4.2.0.101affected
  • 4.3.0 to < 4.3.0.16affected

WSO2 WSO2 Enterprise Mobility Manager

Default version status: unknown

  • 2.2.0 to < 2.2.0.26affected

WSO2 WSO2 Identity Server

Default version status: unaffected

  • 0 to < 5.2.0unknown
  • 5.2.0 to < 5.2.0.32affected
  • 5.3.0 to < 5.3.0.33affected
  • 5.4.1 to < 5.4.1.36affected
  • 5.5.0 to < 5.5.0.50affected
  • 5.6.0 to < 5.6.0.58affected
  • 5.7.0 to < 5.7.0.123affected
  • 5.8.0 to < 5.8.0.106affected
  • 5.9.0 to < 5.9.0.157affected
  • 5.10.0 to < 5.10.0.318affected
  • 5.11.0 to < 5.11.0.365affected
  • 6.0.0 to < 6.0.0.209affected
  • 6.1.0 to < 6.1.0.188affected
  • 7.0.0 to < 7.0.0.60affected

WSO2 WSO2 Identity Server as Key Manager

Default version status: unaffected

  • 0 to < 5.3.0unknown
  • 5.3.0 to < 5.3.0.38affected
  • 5.5.0 to < 5.5.0.51affected
  • 5.6.0 to < 5.6.0.72affected
  • 5.7.0 to < 5.7.0.122affected
  • 5.9.0 to < 5.9.0.165affected
  • 5.10.0 to < 5.10.0.312affected

WSO2 WSO2 Open Banking KM

Default version status: unaffected

  • 0 to < 1.3.0unknown
  • 1.3.0 to < 1.3.0.114affected
  • 1.4.0 to < 1.4.0.130affected
  • 1.5.0 to < 1.5.0.120affected

References