CVE-2024-7074 (GCVE-0-2024-7074)
Vulnerability from cvelistv5
Published
2025-06-02 16:42
Modified
2025-06-02 17:05
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-434 - Unrestricted Upload of File with Dangerous Type
Summary
An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user input in SOAP admin services. A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location on the server.
By leveraging this vulnerability, an attacker could upload a specially crafted payload, potentially achieving remote code execution (RCE) on the server. Exploitation requires valid admin credentials, limiting its impact to authorized but potentially malicious users.
References
| ► | URL | Tags |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ► | WSO2 | WSO2 Enterprise Integrator |
Version: 6.0.0 < 6.0.0.21 Version: 6.1.0 < 6.1.0.38 Version: 6.1.1 < 6.1.1.42 Version: 6.2.0 < 6.2.0.61 Version: 6.3.0 < 6.3.0.69 Version: 6.4.0 < 6.4.0.96 Version: 6.5.0 < 6.5.0.102 Version: 6.6.0 < 6.6.0.198 |
|||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-7074",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-02T17:04:40.480620Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-02T17:05:49.920Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WSO2 Enterprise Integrator",
"vendor": "WSO2",
"versions": [
{
"lessThan": "6.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "6.0.0.21",
"status": "affected",
"version": "6.0.0",
"versionType": "custom"
},
{
"lessThan": "6.1.0.38",
"status": "affected",
"version": "6.1.0",
"versionType": "custom"
},
{
"lessThan": "6.1.1.42",
"status": "affected",
"version": "6.1.1",
"versionType": "custom"
},
{
"lessThan": "6.2.0.61",
"status": "affected",
"version": "6.2.0",
"versionType": "custom"
},
{
"lessThan": "6.3.0.69",
"status": "affected",
"version": "6.3.0",
"versionType": "custom"
},
{
"lessThan": "6.4.0.96",
"status": "affected",
"version": "6.4.0",
"versionType": "custom"
},
{
"lessThan": "6.5.0.102",
"status": "affected",
"version": "6.5.0",
"versionType": "custom"
},
{
"lessThan": "6.6.0.198",
"status": "affected",
"version": "6.6.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 API Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.28",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
},
{
"lessThan": "2.1.0.38",
"status": "affected",
"version": "2.1.0",
"versionType": "custom"
},
{
"lessThan": "2.2.0.57",
"status": "affected",
"version": "2.2.0",
"versionType": "custom"
},
{
"lessThan": "2.5.0.83",
"status": "affected",
"version": "2.5.0",
"versionType": "custom"
},
{
"lessThan": "2.6.0.143",
"status": "affected",
"version": "2.6.0",
"versionType": "custom"
},
{
"lessThan": "3.0.0.162",
"status": "affected",
"version": "3.0.0",
"versionType": "custom"
},
{
"lessThan": "3.1.0.293",
"status": "affected",
"version": "3.1.0",
"versionType": "custom"
},
{
"lessThan": "3.2.0.384",
"status": "affected",
"version": "3.2.0",
"versionType": "custom"
},
{
"lessThan": "3.2.1.16",
"status": "affected",
"version": "3.2.1",
"versionType": "custom"
},
{
"lessThan": "4.0.0.305",
"status": "affected",
"version": "4.0.0",
"versionType": "custom"
},
{
"lessThan": "4.1.0.166",
"status": "affected",
"version": "4.1.0",
"versionType": "custom"
},
{
"lessThan": "4.2.0.100",
"status": "affected",
"version": "4.2.0",
"versionType": "custom"
},
{
"lessThan": "4.3.0.16",
"status": "affected",
"version": "4.3.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "WSO2 Enterprise Service Bus",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.9.0.10",
"status": "affected",
"version": "4.9.0",
"versionType": "custom"
},
{
"lessThan": "5.0.0.28",
"status": "affected",
"version": "5.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "WSO2 Enterprise Mobility Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.2.0.27",
"status": "affected",
"version": "2.2.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Micro Integrator",
"vendor": "WSO2",
"versions": [
{
"lessThan": "1.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "1.0.0.49",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking AM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "1.3.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "1.3.0.132",
"status": "affected",
"version": "1.3.0",
"versionType": "custom"
},
{
"lessThan": "1.4.0.135",
"status": "affected",
"version": "1.4.0",
"versionType": "custom"
},
{
"lessThan": "1.5.0.137",
"status": "affected",
"version": "1.5.0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.342",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.mediation:org.wso2.carbon.mediation.artifactuploader",
"product": "WSO2 Carbon Synapse Artifact Uploader BE",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.4.10.3",
"status": "affected",
"version": "4.4.10",
"versionType": "custom"
},
{
"lessThan": "4.6.1.4",
"status": "affected",
"version": "4.6.1",
"versionType": "custom"
},
{
"lessThan": "4.6.6.9",
"status": "affected",
"version": "4.6.6",
"versionType": "custom"
},
{
"lessThan": "4.6.10.4",
"status": "affected",
"version": "4.6.10",
"versionType": "custom"
},
{
"lessThan": "4.6.16.2",
"status": "affected",
"version": "4.6.16",
"versionType": "custom"
},
{
"lessThan": "4.6.19.10",
"status": "affected",
"version": "4.6.19",
"versionType": "custom"
},
{
"lessThan": "4.6.64.2",
"status": "affected",
"version": "4.6.64",
"versionType": "custom"
},
{
"lessThan": "4.6.67.15",
"status": "affected",
"version": "4.6.67",
"versionType": "custom"
},
{
"lessThan": "4.6.89.12",
"status": "affected",
"version": "4.6.89",
"versionType": "custom"
},
{
"lessThan": "4.6.105.59",
"status": "affected",
"version": "4.6.105",
"versionType": "custom"
},
{
"lessThan": "4.6.150.11",
"status": "affected",
"version": "4.6.150",
"versionType": "custom"
},
{
"lessThan": "4.7.20.5",
"status": "affected",
"version": "4.7.20",
"versionType": "custom"
},
{
"lessThan": "4.7.30.42",
"status": "affected",
"version": "4.7.30",
"versionType": "custom"
},
{
"lessThan": "4.7.35.5",
"status": "affected",
"version": "4.7.35",
"versionType": "custom"
},
{
"lessThan": "4.7.61.56",
"status": "affected",
"version": "4.7.61",
"versionType": "custom"
},
{
"lessThan": "4.7.99.299",
"status": "affected",
"version": "4.7.99",
"versionType": "custom"
},
{
"lessThan": "4.7.131.15",
"status": "affected",
"version": "4.7.131",
"versionType": "custom"
},
{
"lessThan": "4.7.175.18",
"status": "affected",
"version": "4.7.175",
"versionType": "custom"
},
{
"lessThan": "4.7.188.5",
"status": "affected",
"version": "4.7.188",
"versionType": "custom"
},
{
"lessThan": "4.7.204.5",
"status": "affected",
"version": "4.7.204",
"versionType": "custom"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "4.7.216",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Anonymous working with Trend Micro Zero Day Initiative"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user input in SOAP admin services. A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location on the server.\u003cbr\u003e\u003cbr\u003eBy leveraging this vulnerability, an attacker could upload a specially crafted payload, potentially achieving remote code execution (RCE) on the server. Exploitation requires valid admin credentials, limiting its impact to authorized but potentially malicious users.\u003cbr\u003e"
}
],
"value": "An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user input in SOAP admin services. A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location on the server.\n\nBy leveraging this vulnerability, an attacker could upload a specially crafted payload, potentially achieving remote code execution (RCE) on the server. Exploitation requires valid admin credentials, limiting its impact to authorized but potentially malicious users."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-02T16:42:19.264Z",
"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"shortName": "WSO2"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2024-3566/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Follow the instructions given on \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3566/#solution\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3...\u003c/a\u003e \u003cbr\u003e\u003cbr\u003e"
}
],
"value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3... https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3566/#solution"
}
],
"source": {
"advisory": "WSO2-2024-3566",
"discovery": "EXTERNAL"
},
"title": "Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Service Leading to Remote Code Execution",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"assignerShortName": "WSO2",
"cveId": "CVE-2024-7074",
"datePublished": "2025-06-02T16:42:19.264Z",
"dateReserved": "2024-07-24T12:15:52.796Z",
"dateUpdated": "2025-06-02T17:05:49.920Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-7074\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-06-02T17:04:40.480620Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-06-02T17:05:46.176Z\"}}], \"cna\": {\"title\": \"Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Service Leading to Remote Code Execution\", \"source\": {\"advisory\": \"WSO2-2024-3566\", \"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Anonymous working with Trend Micro Zero Day Initiative\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.8, \"attackVector\": \"ADJACENT_NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"WSO2\", \"product\": \"WSO2 Enterprise Integrator\", \"versions\": [{\"status\": \"unknown\", \"version\": \"0\", \"lessThan\": \"6.0.0\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"6.0.0\", \"lessThan\": \"6.0.0.21\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"6.1.0\", \"lessThan\": \"6.1.0.38\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"6.1.1\", \"lessThan\": \"6.1.1.42\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"6.2.0\", \"lessThan\": \"6.2.0.61\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"6.3.0\", \"lessThan\": \"6.3.0.69\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"6.4.0\", \"lessThan\": \"6.4.0.96\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"6.5.0\", \"lessThan\": \"6.5.0.102\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"6.6.0\", \"lessThan\": \"6.6.0.198\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"WSO2\", \"product\": \"WSO2 API Manager\", \"versions\": [{\"status\": \"unknown\", \"version\": \"0\", \"lessThan\": \"2.0.0\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"2.0.0\", \"lessThan\": \"2.0.0.28\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"2.1.0\", \"lessThan\": \"2.1.0.38\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"2.2.0\", \"lessThan\": \"2.2.0.57\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"2.5.0\", \"lessThan\": \"2.5.0.83\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"2.6.0\", \"lessThan\": \"2.6.0.143\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"3.0.0\", \"lessThan\": \"3.0.0.162\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"3.1.0\", \"lessThan\": \"3.1.0.293\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"3.2.0\", \"lessThan\": \"3.2.0.384\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"3.2.1\", \"lessThan\": \"3.2.1.16\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.0.0\", \"lessThan\": \"4.0.0.305\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.1.0\", \"lessThan\": \"4.1.0.166\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.2.0\", \"lessThan\": \"4.2.0.100\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.3.0\", \"lessThan\": \"4.3.0.16\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"WSO2\", \"product\": \"WSO2 Enterprise Service Bus\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.9.0\", \"lessThan\": \"4.9.0.10\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"5.0.0\", \"lessThan\": \"5.0.0.28\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"WSO2\", \"product\": \"WSO2 Enterprise Mobility Manager\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.2.0\", \"lessThan\": \"2.2.0.27\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"WSO2\", \"product\": \"WSO2 Micro Integrator\", \"versions\": [{\"status\": \"unknown\", \"version\": \"0\", \"lessThan\": \"1.0.0\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.0.0\", \"lessThan\": \"1.0.0.49\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"WSO2\", \"product\": \"WSO2 Open Banking AM\", \"versions\": [{\"status\": \"unknown\", \"version\": \"0\", \"lessThan\": \"1.3.0\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.3.0\", \"lessThan\": \"1.3.0.132\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.4.0\", \"lessThan\": \"1.4.0.135\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.5.0\", \"lessThan\": \"1.5.0.137\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"2.0.0\", \"lessThan\": \"2.0.0.342\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"WSO2\", \"product\": \"WSO2 Carbon Synapse Artifact Uploader BE\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.4.10\", \"lessThan\": \"4.4.10.3\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.6.1\", \"lessThan\": \"4.6.1.4\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.6.6\", \"lessThan\": \"4.6.6.9\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.6.10\", \"lessThan\": \"4.6.10.4\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.6.16\", \"lessThan\": \"4.6.16.2\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.6.19\", \"lessThan\": \"4.6.19.10\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.6.64\", \"lessThan\": \"4.6.64.2\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.6.67\", \"lessThan\": \"4.6.67.15\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.6.89\", \"lessThan\": \"4.6.89.12\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.6.105\", \"lessThan\": \"4.6.105.59\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.6.150\", \"lessThan\": \"4.6.150.11\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.7.20\", \"lessThan\": \"4.7.20.5\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.7.30\", \"lessThan\": \"4.7.30.42\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.7.35\", \"lessThan\": \"4.7.35.5\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.7.61\", \"lessThan\": \"4.7.61.56\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.7.99\", \"lessThan\": \"4.7.99.299\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.7.131\", \"lessThan\": \"4.7.131.15\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.7.175\", \"lessThan\": \"4.7.175.18\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.7.188\", \"lessThan\": \"4.7.188.5\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.7.204\", \"lessThan\": \"4.7.204.5\", \"versionType\": \"custom\"}, {\"status\": \"unaffected\", \"version\": \"4.7.216\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"*\"}], \"packageName\": \"org.wso2.carbon.mediation:org.wso2.carbon.mediation.artifactuploader\", \"defaultStatus\": \"unknown\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3... https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3566/#solution\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Follow the instructions given on \u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3566/#solution\\\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3...\u003c/a\u003e \u003cbr\u003e\u003cbr\u003e\", \"base64\": false}]}], \"references\": [{\"url\": \"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2024-3566/\", \"tags\": [\"vendor-advisory\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user input in SOAP admin services. A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location on the server.\\n\\nBy leveraging this vulnerability, an attacker could upload a specially crafted payload, potentially achieving remote code execution (RCE) on the server. Exploitation requires valid admin credentials, limiting its impact to authorized but potentially malicious users.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user input in SOAP admin services. A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location on the server.\u003cbr\u003e\u003cbr\u003eBy leveraging this vulnerability, an attacker could upload a specially crafted payload, potentially achieving remote code execution (RCE) on the server. Exploitation requires valid admin credentials, limiting its impact to authorized but potentially malicious users.\u003cbr\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-434\", \"description\": \"CWE-434 Unrestricted Upload of File with Dangerous Type\"}]}], \"providerMetadata\": {\"orgId\": \"ed10eef1-636d-4fbe-9993-6890dfa878f8\", \"shortName\": \"WSO2\", \"dateUpdated\": \"2025-06-02T16:42:19.264Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2024-7074\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-06-02T17:05:49.920Z\", \"dateReserved\": \"2024-07-24T12:15:52.796Z\", \"assignerOrgId\": \"ed10eef1-636d-4fbe-9993-6890dfa878f8\", \"datePublished\": \"2025-06-02T16:42:19.264Z\", \"assignerShortName\": \"WSO2\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…