CVE-2024-7073
Unauthenticated Server-Side Request Forgery (SSRF) in Multiple WSO2 Products via SOAP Admin Services
MEDIUM 6.5
En bref
- Source
- NVD
- EPSS
- EPSS 0.22 % · centile 13 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- WSO2
- Statut NVD
- Analyzed
Description
A server-side request forgery (SSRF) vulnerability exists in multiple WSO2 products due to improper input validation in SOAP admin services. This flaw allows unauthenticated attackers to manipulate server-side requests, enabling access to internal and external resources available through the network or filesystem. Exploitation of this vulnerability could lead to unauthorized access to sensitive data and systems, including resources within private networks, as long as they are reachable by the affected product.
Faiblesses (CWE)
- CWE-918 — Falsification de requête côté serveur (SSRF)
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | WSO2 |
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | NVD · ed10eef1-636d-4fbe-9993-6890dfa878f8 (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2024-54627
- GCVE · GCVE-0-2024-7073
Configurations affectées (CPE NVD)
cpe:2.3:a:wso2:identity_server:5.2.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:identity_server:5.3.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:identity_server:5.4.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:identity_server:5.4.1:*:*:*:*:*:*:*cpe:2.3:a:wso2:identity_server:5.5.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:identity_server:5.6.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:identity_server:5.7.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:identity_server:5.8.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:identity_server:5.9.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:identity_server:5.10.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:identity_server:5.11.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:identity_server:6.0.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:identity_server:6.1.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:identity_server:7.0.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:identity_server_as_key_manager:5.3.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:identity_server_as_key_manager:5.5.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:identity_server_as_key_manager:5.6.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:identity_server_as_key_manager:5.7.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:identity_server_as_key_manager:5.9.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:identity_server_as_key_manager:5.10.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:open_banking_iam:2.0.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:open_banking_km:1.3.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:open_banking_km:1.4.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:open_banking_km:1.5.0:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| WSO2 · WSO2 Identity Server as Key Manager | unknown 0 < 5.3.0 ; affected 5.3.0 < 5.3.0.37 ; affected 5.5.0 < 5.5.0.50 ; affected 5.6.0 < 5.6.0.71 ; affected 5.7.0 < 5.7.0.122 ; affected 5.9.0 < 5.9.0.165 |
| WSO2 · WSO2 Identity Server | unknown 0 < 5.2.0 ; affected 5.2.0 < 5.2.0.32 ; affected 5.3.0 < 5.3.0.32 ; affected 5.4.0 < 5.4.0.31 ; affected 5.4.1 < 5.4.1.36 ; affected 5.5.0 < 5.5.0.49 |
| WSO2 · WSO2 Open Banking KM | unknown 0 < 1.3.0 ; affected 1.3.0 < 1.3.0.114 ; affected 1.4.0 < 1.4.0.130 ; affected 1.5.0 < 1.5.0.120 |
| WSO2 · WSO2 Open Banking IAM | unknown 0 < 2.0.0 ; affected 2.0.0 < 2.0.0.363 |
| WSO2 · WSO2 Carbon Policy Editor BE | affected 5.2.2 < 5.2.2.14 ; affected 5.7.5 < 5.7.5.15 ; affected 5.10.86 < 5.10.86.5 ; affected 5.10.112 < 5.10.112.16 ; affected 5.11.148 < 5.11.148.15 ; affected 5.11.256 < 5.11.256.17 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |