CVE-2024-7097
An incorrect authorization vulnerability exists in multiple WSO2 products due to a flaw in the SOAP admin service, which allows user account creation regardless of the self-registration configuration settings. This vulnerability enables malicious actors to create new user accounts without proper authorization. Exploitation of this flaw could allow an attacker to create multiple low-privileged user accounts, gaining unauthorized access to the system. Additionally, continuous exploitation could lead to system resource exhaustion through mass user creation.
- Score
- CVSS 3.1 4.3 Medium
- Status
- Analyzed - ed10eef1-636d-4fbe-9993-6890dfa878f8
- Published
- 2025-05-30
- Last modified
- 2025-05-30
- Weaknesses
- CWE-863
Affected products
- Api Manager (Wso2)
- Identity Server (Wso2)
- Identity Server As Key Manager (Wso2)
- Open Banking Am (Wso2)
- Open Banking Iam (Wso2)
- Open Banking Km (Wso2)
- Wso2 Api Manager (Wso2)
- Wso2 Enterprise Mobility Manager (Wso2)
- Wso2 Identity Server (Wso2)
- Wso2 Identity Server As Key Manager (Wso2)
- Wso2 Open Banking Am (Wso2)
- Wso2 Open Banking Iam (Wso2)
- Wso2 Open Banking Km (Wso2)
References
- https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3574/
