medium4.3
CVE-2024-7097
An incorrect authorization vulnerability exists in multiple WSO2 products due to a flaw in the SOAP admin service, which allows user account creation regardles…
Impact
An incorrect authorization vulnerability exists in multiple WSO2 products due to a flaw in the SOAP admin service, which allows user account creation regardless of the self-registration configuration settings. This vulnerability enables malicious actors to create new user accounts without proper authorization. Exploitation of this flaw could allow an attacker to create multiple low-privileged user accounts, gaining unauthorized access to the system. Additionally, continuous exploitation could lead to system resource exhaustion through mass user creation.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Wso2 | Api Manager | Versions 2.1.0, 2.2.0, 2.5.0, 2.6.0, 3.0.0, 3.1.0 |
| Wso2 | Identity Server | Versions 5.2.0, 5.3.0, 5.4.0, 5.4.1, 5.5.0, 5.6.0 |
| Wso2 | Identity Server As Key Manager | Versions 5.3.0, 5.5.0, 5.6.0, 5.7.0, 5.9.0, 5.10.0 |
| Wso2 | Open Banking Am | Version 2.0.0 |
| Wso2 | Open Banking Iam | Version 2.0.0 |
| Wso2 | Open Banking Km | Versions 1.3.0, 1.4.0, 1.5.0 |