{"id":"CVE-2024-7097","state":"PUBLISHED","title":"Incorrect Authorization in Multiple WSO2 Products via SOAP Admin Service Allowing Unauthorized User Signup","description":"An incorrect authorization vulnerability exists in multiple WSO2 products due to a flaw in the SOAP admin service, which allows user account creation regardless of the self-registration configuration settings. This vulnerability enables malicious actors to create new user accounts without proper authorization.\n\nExploitation of this flaw could allow an attacker to create multiple low-privileged user accounts, gaining unauthorized access to the system. Additionally, continuous exploitation could lead to system resource exhaustion through mass user creation.","publishedAt":"2025-05-30T15:04:09.940Z","updatedAt":"2025-05-30T16:12:44.804Z","severity":{"score":4.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","source":"WSO2"},"assigner":"WSO2","products":["WSO2 WSO2 Open Banking AM","WSO2 WSO2 Open Banking KM","WSO2 WSO2 Identity Server as Key Manager","WSO2 WSO2 API Manager","WSO2 WSO2 Identity Server","WSO2 WSO2 Open Banking IAM","WSO2 WSO2 Enterprise Mobility Manager"],"affected":[{"vendor":"WSO2","product":"WSO2 Open Banking AM","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"1.3.0","versionType":"custom"},{"version":"1.3.0","status":"affected","lessThan":"1.3.0.131","versionType":"custom"},{"version":"1.4.0","status":"affected","lessThan":"1.4.0.134","versionType":"custom"},{"version":"1.5.0","status":"affected","lessThan":"1.5.0.136","versionType":"custom"},{"version":"2.0.0","status":"affected","lessThan":"2.0.0.343","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Open Banking KM","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"1.3.0","versionType":"custom"},{"version":"1.3.0","status":"affected","lessThan":"1.3.0.114","versionType":"custom"},{"version":"1.4.0","status":"affected","lessThan":"1.4.0.130","versionType":"custom"},{"version":"1.5.0","status":"affected","lessThan":"1.5.0.120","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Identity Server as Key Manager","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"5.3.0","versionType":"custom"},{"version":"5.3.0","status":"affected","lessThan":"5.3.0.38","versionType":"custom"},{"version":"5.5.0","status":"affected","lessThan":"5.5.0.51","versionType":"custom"},{"version":"5.6.0","status":"affected","lessThan":"5.6.0.72","versionType":"custom"},{"version":"5.7.0","status":"affected","lessThan":"5.7.0.122","versionType":"custom"},{"version":"5.9.0","status":"affected","lessThan":"5.9.0.165","versionType":"custom"},{"version":"5.10.0","status":"affected","lessThan":"5.10.0.312","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 API Manager","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"2.0.0","versionType":"custom"},{"version":"2.0.0","status":"affected","lessThan":"2.0.0.29","versionType":"custom"},{"version":"2.1.0","status":"affected","lessThan":"2.1.0.39","versionType":"custom"},{"version":"2.2.0","status":"affected","lessThan":"2.2.0.56","versionType":"custom"},{"version":"2.5.0","status":"affected","lessThan":"2.5.0.83","versionType":"custom"},{"version":"2.6.0","status":"affected","lessThan":"2.6.0.142","versionType":"custom"},{"version":"3.0.0","status":"affected","lessThan":"3.0.0.162","versionType":"custom"},{"version":"3.1.0","status":"affected","lessThan":"3.1.0.294","versionType":"custom"},{"version":"3.2.0","status":"affected","lessThan":"3.2.0.384","versionType":"custom"},{"version":"3.2.1","status":"affected","lessThan":"3.2.1.16","versionType":"custom"},{"version":"4.0.0","status":"affected","lessThan":"4.0.0.305","versionType":"custom"},{"version":"4.1.0","status":"affected","lessThan":"4.1.0.166","versionType":"custom"},{"version":"4.2.0","status":"affected","lessThan":"4.2.0.101","versionType":"custom"},{"version":"4.3.0","status":"affected","lessThan":"4.3.0.16","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Identity Server","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"5.2.0","versionType":"custom"},{"version":"5.2.0","status":"affected","lessThan":"5.2.0.32","versionType":"custom"},{"version":"5.3.0","status":"affected","lessThan":"5.3.0.33","versionType":"custom"},{"version":"5.4.0","status":"affected","lessThan":"5.4.0.32","versionType":"custom"},{"version":"5.4.1","status":"affected","lessThan":"5.4.1.36","versionType":"custom"},{"version":"5.5.0","status":"affected","lessThan":"5.5.0.50","versionType":"custom"},{"version":"5.6.0","status":"affected","lessThan":"5.6.0.58","versionType":"custom"},{"version":"5.7.0","status":"affected","lessThan":"5.7.0.123","versionType":"custom"},{"version":"5.8.0","status":"affected","lessThan":"5.8.0.106","versionType":"custom"},{"version":"5.9.0","status":"affected","lessThan":"5.9.0.157","versionType":"custom"},{"version":"5.10.0","status":"affected","lessThan":"5.10.0.318","versionType":"custom"},{"version":"5.11.0","status":"affected","lessThan":"5.11.0.365","versionType":"custom"},{"version":"6.0.0","status":"affected","lessThan":"6.0.0.209","versionType":"custom"},{"version":"6.1.0","status":"affected","lessThan":"6.1.0.188","versionType":"custom"},{"version":"7.0.0","status":"affected","lessThan":"7.0.0.60","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Open Banking IAM","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"2.0.0","versionType":"custom"},{"version":"2.0.0","status":"affected","lessThan":"2.0.0.364","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Enterprise Mobility Manager","defaultStatus":"unknown","versions":[{"version":"2.2.0","status":"affected","lessThan":"2.2.0.26","versionType":"custom"}]}],"references":["https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3574/"],"weaknesses":["CWE-863"],"ingestedAt":"2026-10-29T20:08:20.985Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/7xxx/CVE-2024-7097.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-7097","state":"PUBLISHED","datePublished":"2025-05-30T15:04:09.940Z","dateUpdated":"2025-05-30T16:12:44.804Z","assignerShortName":"WSO2","assignerOrgId":"ed10eef1-636d-4fbe-9993-6890dfa878f8","dateReserved":"2024-07-25T07:26:31.718Z"},"containers":{"cna":{"title":"Incorrect Authorization in Multiple WSO2 Products via SOAP Admin Service Allowing Unauthorized User Signup","descriptions":[{"lang":"en","value":"An incorrect authorization vulnerability exists in multiple WSO2 products due to a flaw in the SOAP admin service, which allows user account creation regardless of the self-registration configuration settings. This vulnerability enables malicious actors to create new user accounts without proper authorization.\n\nExploitation of this flaw could allow an attacker to create multiple low-privileged user accounts, gaining unauthorized access to the system. Additionally, continuous exploitation could lead to system resource exhaustion through mass user creation."}],"affected":[{"vendor":"WSO2","product":"WSO2 Open Banking AM","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"1.3.0","versionType":"custom"},{"version":"1.3.0","status":"affected","lessThan":"1.3.0.131","versionType":"custom"},{"version":"1.4.0","status":"affected","lessThan":"1.4.0.134","versionType":"custom"},{"version":"1.5.0","status":"affected","lessThan":"1.5.0.136","versionType":"custom"},{"version":"2.0.0","status":"affected","lessThan":"2.0.0.343","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Open Banking KM","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"1.3.0","versionType":"custom"},{"version":"1.3.0","status":"affected","lessThan":"1.3.0.114","versionType":"custom"},{"version":"1.4.0","status":"affected","lessThan":"1.4.0.130","versionType":"custom"},{"version":"1.5.0","status":"affected","lessThan":"1.5.0.120","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Identity Server as Key Manager","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"5.3.0","versionType":"custom"},{"version":"5.3.0","status":"affected","lessThan":"5.3.0.38","versionType":"custom"},{"version":"5.5.0","status":"affected","lessThan":"5.5.0.51","versionType":"custom"},{"version":"5.6.0","status":"affected","lessThan":"5.6.0.72","versionType":"custom"},{"version":"5.7.0","status":"affected","lessThan":"5.7.0.122","versionType":"custom"},{"version":"5.9.0","status":"affected","lessThan":"5.9.0.165","versionType":"custom"},{"version":"5.10.0","status":"affected","lessThan":"5.10.0.312","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 API Manager","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"2.0.0","versionType":"custom"},{"version":"2.0.0","status":"affected","lessThan":"2.0.0.29","versionType":"custom"},{"version":"2.1.0","status":"affected","lessThan":"2.1.0.39","versionType":"custom"},{"version":"2.2.0","status":"affected","lessThan":"2.2.0.56","versionType":"custom"},{"version":"2.5.0","status":"affected","lessThan":"2.5.0.83","versionType":"custom"},{"version":"2.6.0","status":"affected","lessThan":"2.6.0.142","versionType":"custom"},{"version":"3.0.0","status":"affected","lessThan":"3.0.0.162","versionType":"custom"},{"version":"3.1.0","status":"affected","lessThan":"3.1.0.294","versionType":"custom"},{"version":"3.2.0","status":"affected","lessThan":"3.2.0.384","versionType":"custom"},{"version":"3.2.1","status":"affected","lessThan":"3.2.1.16","versionType":"custom"},{"version":"4.0.0","status":"affected","lessThan":"4.0.0.305","versionType":"custom"},{"version":"4.1.0","status":"affected","lessThan":"4.1.0.166","versionType":"custom"},{"version":"4.2.0","status":"affected","lessThan":"4.2.0.101","versionType":"custom"},{"version":"4.3.0","status":"affected","lessThan":"4.3.0.16","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Identity Server","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"5.2.0","versionType":"custom"},{"version":"5.2.0","status":"affected","lessThan":"5.2.0.32","versionType":"custom"},{"version":"5.3.0","status":"affected","lessThan":"5.3.0.33","versionType":"custom"},{"version":"5.4.0","status":"affected","lessThan":"5.4.0.32","versionType":"custom"},{"version":"5.4.1","status":"affected","lessThan":"5.4.1.36","versionType":"custom"},{"version":"5.5.0","status":"affected","lessThan":"5.5.0.50","versionType":"custom"},{"version":"5.6.0","status":"affected","lessThan":"5.6.0.58","versionType":"custom"},{"version":"5.7.0","status":"affected","lessThan":"5.7.0.123","versionType":"custom"},{"version":"5.8.0","status":"affected","lessThan":"5.8.0.106","versionType":"custom"},{"version":"5.9.0","status":"affected","lessThan":"5.9.0.157","versionType":"custom"},{"version":"5.10.0","status":"affected","lessThan":"5.10.0.318","versionType":"custom"},{"version":"5.11.0","status":"affected","lessThan":"5.11.0.365","versionType":"custom"},{"version":"6.0.0","status":"affected","lessThan":"6.0.0.209","versionType":"custom"},{"version":"6.1.0","status":"affected","lessThan":"6.1.0.188","versionType":"custom"},{"version":"7.0.0","status":"affected","lessThan":"7.0.0.60","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Open Banking IAM","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"2.0.0","versionType":"custom"},{"version":"2.0.0","status":"affected","lessThan":"2.0.0.364","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Enterprise Mobility Manager","defaultStatus":"unknown","versions":[{"version":"2.2.0","status":"affected","lessThan":"2.2.0.26","versionType":"custom"}]}],"references":[{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3574/","tags":["vendor-advisory"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"providerMetadata":{"shortName":"WSO2","orgId":"ed10eef1-636d-4fbe-9993-6890dfa878f8","dateUpdated":"2025-05-30T15:04:09.940Z"},"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<span style=\"background-color: transparent;\">Follow the instructions given on&nbsp;<a target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3574/#solution\">https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3...</a></span><br>"}],"value":"Follow the instructions given on  https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3... https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3574/#solution"}],"source":{"advisory":"WSO2-2024-3574","discovery":"INTERNAL"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-05-30T16:05:35.324157Z","id":"CVE-2024-7097","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-863","type":"CWE","lang":"en","description":"CWE-863 Incorrect Authorization"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-05-30T16:12:44.804Z"}}]}}}