Skip to content
CVE PROGRAM SOURCE RECORD4.3 Medium

CVE-2024-7097

Incorrect Authorization in Multiple WSO2 Products via SOAP Admin Service Allowing Unauthorized User Signup

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WSO2

Description

An incorrect authorization vulnerability exists in multiple WSO2 products due to a flaw in the SOAP admin service, which allows user account creation regardless of the self-registration configuration settings. This vulnerability enables malicious actors to create new user accounts without proper authorization. Exploitation of this flaw could allow an attacker to create multiple low-privileged user accounts, gaining unauthorized access to the system. Additionally, continuous exploitation could lead to system resource exhaustion through mass user creation.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

WSO2 WSO2 Open Banking AM

Default version status: unaffected

  • 0 to < 1.3.0unknown
  • 1.3.0 to < 1.3.0.131affected
  • 1.4.0 to < 1.4.0.134affected
  • 1.5.0 to < 1.5.0.136affected
  • 2.0.0 to < 2.0.0.343affected

WSO2 WSO2 Open Banking KM

Default version status: unaffected

  • 0 to < 1.3.0unknown
  • 1.3.0 to < 1.3.0.114affected
  • 1.4.0 to < 1.4.0.130affected
  • 1.5.0 to < 1.5.0.120affected

WSO2 WSO2 Identity Server as Key Manager

Default version status: unaffected

  • 0 to < 5.3.0unknown
  • 5.3.0 to < 5.3.0.38affected
  • 5.5.0 to < 5.5.0.51affected
  • 5.6.0 to < 5.6.0.72affected
  • 5.7.0 to < 5.7.0.122affected
  • 5.9.0 to < 5.9.0.165affected
  • 5.10.0 to < 5.10.0.312affected

WSO2 WSO2 API Manager

Default version status: unaffected

  • 0 to < 2.0.0unknown
  • 2.0.0 to < 2.0.0.29affected
  • 2.1.0 to < 2.1.0.39affected
  • 2.2.0 to < 2.2.0.56affected
  • 2.5.0 to < 2.5.0.83affected
  • 2.6.0 to < 2.6.0.142affected
  • 3.0.0 to < 3.0.0.162affected
  • 3.1.0 to < 3.1.0.294affected
  • 3.2.0 to < 3.2.0.384affected
  • 3.2.1 to < 3.2.1.16affected
  • 4.0.0 to < 4.0.0.305affected
  • 4.1.0 to < 4.1.0.166affected
  • 4.2.0 to < 4.2.0.101affected
  • 4.3.0 to < 4.3.0.16affected

WSO2 WSO2 Identity Server

Default version status: unaffected

  • 0 to < 5.2.0unknown
  • 5.2.0 to < 5.2.0.32affected
  • 5.3.0 to < 5.3.0.33affected
  • 5.4.0 to < 5.4.0.32affected
  • 5.4.1 to < 5.4.1.36affected
  • 5.5.0 to < 5.5.0.50affected
  • 5.6.0 to < 5.6.0.58affected
  • 5.7.0 to < 5.7.0.123affected
  • 5.8.0 to < 5.8.0.106affected
  • 5.9.0 to < 5.9.0.157affected
  • 5.10.0 to < 5.10.0.318affected
  • 5.11.0 to < 5.11.0.365affected
  • 6.0.0 to < 6.0.0.209affected
  • 6.1.0 to < 6.1.0.188affected
  • 7.0.0 to < 7.0.0.60affected

WSO2 WSO2 Open Banking IAM

Default version status: unaffected

  • 0 to < 2.0.0unknown
  • 2.0.0 to < 2.0.0.364affected

WSO2 WSO2 Enterprise Mobility Manager

Default version status: unknown

  • 2.2.0 to < 2.2.0.26affected

References