Skip to content
Fencer Intel
medium 6.8

CVE-2024-7074 json

Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Service Leading to Remote Code Execution

published last yr. modified 4mo ago also EUVD-2024-54628

cvss
6.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
17.7%
EPSS 17.7% chance of exploitation in 30 days, percentile 97%
public exploits
0
none known

Summary

An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user input in SOAP admin services. A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location on the server.

By leveraging this vulnerability, an attacker could upload a specially crafted payload, potentially achieving remote code execution (RCE) on the server. Exploitation requires valid admin credentials, limiting its impact to authorized but potentially malicious users.

Patch / fix

  • WSO2 WSO2 Enterprise Integrator 6.0.0.21, 6.1.0.38, 6.1.1.42, 6.2.0.61, 6.3.0.69, 6.4.0.96, 6.5.0.102, 6.6.0.198
  • WSO2 WSO2 API Manager 2.0.0.28, 2.1.0.38, 2.2.0.57, 2.5.0.83, 2.6.0.143, 3.0.0.162, 3.1.0.293, 3.2.0.384, 3.2.1.16, 4.0.0.305, 4.1.0.166, 4.2.0.100, 4.3.0.16
  • WSO2 WSO2 Enterprise Service Bus 4.9.0.10, 5.0.0.28
  • WSO2 WSO2 Enterprise Mobility Manager 2.2.0.27
  • WSO2 WSO2 Micro Integrator 1.0.0.49
  • WSO2 WSO2 Open Banking AM 1.3.0.132, 1.4.0.135, 1.5.0.137, 2.0.0.342
  • WSO2 WSO2 Carbon Synapse Artifact Uploader BE 4.4.10.3, 4.6.1.4, 4.6.6.9, 4.6.10.4, 4.6.16.2, 4.6.19.10, 4.6.64.2, 4.6.67.15, 4.6.89.12, 4.6.105.59, 4.6.150.11, 4.7.20.5, 4.7.30.42, 4.7.35.5, 4.7.61.56, 4.7.99.299, 4.7.131.15, 4.7.175.18, 4.7.188.5, 4.7.204.5

Is CVE-2024-7074 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
last yr.

Exploit prediction

17.71% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-11).

CVSS scores

assigned by version score vector
CNA 3.1 6.8 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

  • WSO2 WSO2 Enterprise Integrator
  • WSO2 WSO2 API Manager
  • WSO2 WSO2 Enterprise Service Bus
  • WSO2 WSO2 Enterprise Mobility Manager
  • WSO2 WSO2 Micro Integrator
  • WSO2 WSO2 Open Banking AM
  • WSO2 WSO2 Carbon Synapse Artifact Uploader BE

Classification

Weakness
  • CWE-434 Unrestricted Upload of File with Dangerous Type

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.