CVSS: 6.5EPSS: 0%CPEs: 38EXPL: 0CVE-2024-7073 – Unauthenticated Server-Side Request Forgery (SSRF) in Multiple WSO2 Products via SOAP Admin Services
https://notcve.org/view.php?id=CVE-2024-7073
02 Jun 2025 — A server-side request forgery (SSRF) vulnerability exists in multiple WSO2 products due to improper input validation in SOAP admin services. This flaw allows unauthenticated attackers to manipulate server-side requests, enabling access to internal and external resources available through the network or filesystem. Exploitation of this vulnerability could lead to unauthorized access to sensitive data and systems, including resources within private networks, as long as they are reachable by the affected produ... • https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3562 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 4.3EPSS: 0%CPEs: 42EXPL: 0CVE-2024-7097 – Incorrect Authorization in Multiple WSO2 Products via SOAP Admin Service Allowing Unauthorized User Signup
https://notcve.org/view.php?id=CVE-2024-7097
30 May 2025 — An incorrect authorization vulnerability exists in multiple WSO2 products due to a flaw in the SOAP admin service, which allows user account creation regardless of the self-registration configuration settings. This vulnerability enables malicious actors to create new user accounts without proper authorization. Exploitation of this flaw could allow an attacker to create multiple low-privileged user accounts, gaining unauthorized access to the system. Additionally, continuous exploitation could lead to system... • https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3574 • CWE-863: Incorrect Authorization •
CVSS: 4.2EPSS: 0%CPEs: 41EXPL: 0CVE-2024-7096 – Privilege Escalation in Multiple WSO2 Products via SOAP Admin Service Due to Business Logic Flaw
https://notcve.org/view.php?id=CVE-2024-7096
30 May 2025 — A privilege escalation vulnerability exists in multiple [Vendor Name] products due to a business logic flaw in SOAP admin services. A malicious actor can create a new user with elevated permissions only when all of the following conditions are met: * SOAP admin services are accessible to the attacker. * The deployment includes an internally used attribute that is not part of the default WSO2 product configuration. * At least one custom role exists with non-default permissions. * The attacker has knowledge o... • https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3573 • CWE-863: Incorrect Authorization •
CVSS: 10.0EPSS: 0%CPEs: 58EXPL: 0CVE-2024-6914 – Incorrect Authorization in Multiple WSO2 Products via Account Recovery SOAP Admin Service Leading to Account Takeover
https://notcve.org/view.php?id=CVE-2024-6914
30 Dec 2024 — An incorrect authorization vulnerability exists in multiple WSO2 products due to a business logic flaw in the account recovery-related SOAP admin service. A malicious actor can exploit this vulnerability to reset the password of any user account, leading to a complete account takeover, including accounts with elevated privileges. This vulnerability is exploitable only through the account recovery SOAP admin services exposed via the "/services" context path in affected products. The impact may be reduced if ... • https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3561 • CWE-863: Incorrect Authorization •