// For flags

CVE-2024-7096

Privilege Escalation in Multiple WSO2 Products via SOAP Admin Service Due to Business Logic Flaw

Severity Score

4.2
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track
*SSVC
Descriptions

A privilege escalation vulnerability exists in multiple [Vendor Name] products due to a business logic flaw in SOAP admin services. A malicious actor can create a new user with elevated permissions only when all of the following conditions are met: * SOAP admin services are accessible to the attacker. * The deployment includes an internally used attribute that is not part of the default WSO2 product configuration. * At least one custom role exists with non-default permissions. * The attacker has knowledge of the custom role and the internal attribute used in the deployment. Exploiting this vulnerability allows malicious actors to assign higher privileges to self-registered users, bypassing intended access control mechanisms.

*Credits: N/A
CVSS Scores
Attack Vector
Adjacent
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
Attack Vector
Adjacent
Attack Complexity
High
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Track
Exploitation
None
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2024-07-25 CVE Reserved
  • 2025-05-30 CVE Published
  • 2025-05-30 CVE Updated
  • 2025-07-01 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-863: Incorrect Authorization
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
WSO2
Search vendor "WSO2"
WSO2 Open Banking IAM
Search vendor "WSO2" for product "WSO2 Open Banking IAM"
>= 2.0.0.0 < 2.0.0.364
Search vendor "WSO2" for product "WSO2 Open Banking IAM" and version " >= 2.0.0.0 < 2.0.0.364"
en
Affected
WSO2
Search vendor "WSO2"
WSO2 Open Banking AM
Search vendor "WSO2" for product "WSO2 Open Banking AM"
>= 1.3.0.0 < 1.3.0.131
Search vendor "WSO2" for product "WSO2 Open Banking AM" and version " >= 1.3.0.0 < 1.3.0.131"
en
Affected
WSO2
Search vendor "WSO2"
WSO2 Open Banking AM
Search vendor "WSO2" for product "WSO2 Open Banking AM"
>= 1.4.0.0 < 1.4.0.134
Search vendor "WSO2" for product "WSO2 Open Banking AM" and version " >= 1.4.0.0 < 1.4.0.134"
en
Affected
WSO2
Search vendor "WSO2"
WSO2 Open Banking AM
Search vendor "WSO2" for product "WSO2 Open Banking AM"
>= 1.5.0.0 < 1.5.0.136
Search vendor "WSO2" for product "WSO2 Open Banking AM" and version " >= 1.5.0.0 < 1.5.0.136"
en
Affected
WSO2
Search vendor "WSO2"
WSO2 Open Banking AM
Search vendor "WSO2" for product "WSO2 Open Banking AM"
>= 2.0.0.0 < 2.0.0.343
Search vendor "WSO2" for product "WSO2 Open Banking AM" and version " >= 2.0.0.0 < 2.0.0.343"
en
Affected
WSO2
Search vendor "WSO2"
WSO2 API Manager
Search vendor "WSO2" for product "WSO2 API Manager"
>= 2.0.0.0 < 2.0.0.29
Search vendor "WSO2" for product "WSO2 API Manager" and version " >= 2.0.0.0 < 2.0.0.29"
en
Affected
WSO2
Search vendor "WSO2"
WSO2 API Manager
Search vendor "WSO2" for product "WSO2 API Manager"
>= 2.1.0.0 < 2.1.0.39
Search vendor "WSO2" for product "WSO2 API Manager" and version " >= 2.1.0.0 < 2.1.0.39"
en
Affected
WSO2
Search vendor "WSO2"
WSO2 API Manager
Search vendor "WSO2" for product "WSO2 API Manager"
>= 2.2.0.0 < 2.2.0.56
Search vendor "WSO2" for product "WSO2 API Manager" and version " >= 2.2.0.0 < 2.2.0.56"
en
Affected
WSO2
Search vendor "WSO2"
WSO2 API Manager
Search vendor "WSO2" for product "WSO2 API Manager"
>= 2.5.0.0 < 2.5.0.83
Search vendor "WSO2" for product "WSO2 API Manager" and version " >= 2.5.0.0 < 2.5.0.83"
en
Affected
WSO2
Search vendor "WSO2"
WSO2 API Manager
Search vendor "WSO2" for product "WSO2 API Manager"
>= 2.6.0.0 < 2.6.0.142
Search vendor "WSO2" for product "WSO2 API Manager" and version " >= 2.6.0.0 < 2.6.0.142"
en
Affected
WSO2
Search vendor "WSO2"
WSO2 API Manager
Search vendor "WSO2" for product "WSO2 API Manager"
>= 3.0.0.0 < 3.0.0.162
Search vendor "WSO2" for product "WSO2 API Manager" and version " >= 3.0.0.0 < 3.0.0.162"
en
Affected
WSO2
Search vendor "WSO2"
WSO2 API Manager
Search vendor "WSO2" for product "WSO2 API Manager"
>= 3.1.0.0 < 3.1.0.294
Search vendor "WSO2" for product "WSO2 API Manager" and version " >= 3.1.0.0 < 3.1.0.294"
en
Affected
WSO2
Search vendor "WSO2"
WSO2 API Manager
Search vendor "WSO2" for product "WSO2 API Manager"
>= 3.2.0.0 < 3.2.0.384
Search vendor "WSO2" for product "WSO2 API Manager" and version " >= 3.2.0.0 < 3.2.0.384"
en
Affected
WSO2
Search vendor "WSO2"
WSO2 API Manager
Search vendor "WSO2" for product "WSO2 API Manager"
>= 3.2.1.0 < 3.2.1.16
Search vendor "WSO2" for product "WSO2 API Manager" and version " >= 3.2.1.0 < 3.2.1.16"
en
Affected
WSO2
Search vendor "WSO2"
WSO2 API Manager
Search vendor "WSO2" for product "WSO2 API Manager"
>= 4.0.0.0 < 4.0.0.305
Search vendor "WSO2" for product "WSO2 API Manager" and version " >= 4.0.0.0 < 4.0.0.305"
en
Affected
WSO2
Search vendor "WSO2"
WSO2 API Manager
Search vendor "WSO2" for product "WSO2 API Manager"
>= 4.1.0.0 < 4.1.0.166
Search vendor "WSO2" for product "WSO2 API Manager" and version " >= 4.1.0.0 < 4.1.0.166"
en
Affected
WSO2
Search vendor "WSO2"
WSO2 API Manager
Search vendor "WSO2" for product "WSO2 API Manager"
>= 4.2.0.0 < 4.2.0.101
Search vendor "WSO2" for product "WSO2 API Manager" and version " >= 4.2.0.0 < 4.2.0.101"
en
Affected
WSO2
Search vendor "WSO2"
WSO2 API Manager
Search vendor "WSO2" for product "WSO2 API Manager"
>= 4.3.0.0 < 4.3.0.16
Search vendor "WSO2" for product "WSO2 API Manager" and version " >= 4.3.0.0 < 4.3.0.16"
en
Affected
WSO2
Search vendor "WSO2"
WSO2 Enterprise Mobility Manager
Search vendor "WSO2" for product "WSO2 Enterprise Mobility Manager"
>= 2.2.0.0 < 2.2.0.26
Search vendor "WSO2" for product "WSO2 Enterprise Mobility Manager" and version " >= 2.2.0.0 < 2.2.0.26"
en
Affected
WSO2
Search vendor "WSO2"
WSO2 Identity Server
Search vendor "WSO2" for product "WSO2 Identity Server"
>= 5.2.0.0 < 5.2.0.32
Search vendor "WSO2" for product "WSO2 Identity Server" and version " >= 5.2.0.0 < 5.2.0.32"
en
Affected
WSO2
Search vendor "WSO2"
WSO2 Identity Server
Search vendor "WSO2" for product "WSO2 Identity Server"
>= 5.3.0.0 < 5.3.0.33
Search vendor "WSO2" for product "WSO2 Identity Server" and version " >= 5.3.0.0 < 5.3.0.33"
en
Affected
WSO2
Search vendor "WSO2"
WSO2 Identity Server
Search vendor "WSO2" for product "WSO2 Identity Server"
>= 5.4.1.0 < 5.4.1.36
Search vendor "WSO2" for product "WSO2 Identity Server" and version " >= 5.4.1.0 < 5.4.1.36"
en
Affected
WSO2
Search vendor "WSO2"
WSO2 Identity Server
Search vendor "WSO2" for product "WSO2 Identity Server"
>= 5.5.0.0 < 5.5.0.50
Search vendor "WSO2" for product "WSO2 Identity Server" and version " >= 5.5.0.0 < 5.5.0.50"
en
Affected
WSO2
Search vendor "WSO2"
WSO2 Identity Server
Search vendor "WSO2" for product "WSO2 Identity Server"
>= 5.6.0.0 < 5.6.0.58
Search vendor "WSO2" for product "WSO2 Identity Server" and version " >= 5.6.0.0 < 5.6.0.58"
en
Affected
WSO2
Search vendor "WSO2"
WSO2 Identity Server
Search vendor "WSO2" for product "WSO2 Identity Server"
>= 5.7.0.0 < 5.7.0.123
Search vendor "WSO2" for product "WSO2 Identity Server" and version " >= 5.7.0.0 < 5.7.0.123"
en
Affected
WSO2
Search vendor "WSO2"
WSO2 Identity Server
Search vendor "WSO2" for product "WSO2 Identity Server"
>= 5.8.0.0 < 5.8.0.106
Search vendor "WSO2" for product "WSO2 Identity Server" and version " >= 5.8.0.0 < 5.8.0.106"
en
Affected
WSO2
Search vendor "WSO2"
WSO2 Identity Server
Search vendor "WSO2" for product "WSO2 Identity Server"
>= 5.9.0.0 < 5.9.0.157
Search vendor "WSO2" for product "WSO2 Identity Server" and version " >= 5.9.0.0 < 5.9.0.157"
en
Affected
WSO2
Search vendor "WSO2"
WSO2 Identity Server
Search vendor "WSO2" for product "WSO2 Identity Server"
>= 5.10.0.0 < 5.10.0.318
Search vendor "WSO2" for product "WSO2 Identity Server" and version " >= 5.10.0.0 < 5.10.0.318"
en
Affected
WSO2
Search vendor "WSO2"
WSO2 Identity Server
Search vendor "WSO2" for product "WSO2 Identity Server"
>= 5.11.0.0 < 5.11.0.365
Search vendor "WSO2" for product "WSO2 Identity Server" and version " >= 5.11.0.0 < 5.11.0.365"
en
Affected
WSO2
Search vendor "WSO2"
WSO2 Identity Server
Search vendor "WSO2" for product "WSO2 Identity Server"
>= 6.0.0.0 < 6.0.0.209
Search vendor "WSO2" for product "WSO2 Identity Server" and version " >= 6.0.0.0 < 6.0.0.209"
en
Affected
WSO2
Search vendor "WSO2"
WSO2 Identity Server
Search vendor "WSO2" for product "WSO2 Identity Server"
>= 6.1.0.0 < 6.1.0.188
Search vendor "WSO2" for product "WSO2 Identity Server" and version " >= 6.1.0.0 < 6.1.0.188"
en
Affected
WSO2
Search vendor "WSO2"
WSO2 Identity Server
Search vendor "WSO2" for product "WSO2 Identity Server"
>= 7.0.0.0 < 7.0.0.60
Search vendor "WSO2" for product "WSO2 Identity Server" and version " >= 7.0.0.0 < 7.0.0.60"
en
Affected
WSO2
Search vendor "WSO2"
WSO2 Identity Server As Key Manager
Search vendor "WSO2" for product "WSO2 Identity Server As Key Manager"
>= 5.3.0.0 < 5.3.0.38
Search vendor "WSO2" for product "WSO2 Identity Server As Key Manager" and version " >= 5.3.0.0 < 5.3.0.38"
en
Affected
WSO2
Search vendor "WSO2"
WSO2 Identity Server As Key Manager
Search vendor "WSO2" for product "WSO2 Identity Server As Key Manager"
>= 5.5.0.0 < 5.5.0.51
Search vendor "WSO2" for product "WSO2 Identity Server As Key Manager" and version " >= 5.5.0.0 < 5.5.0.51"
en
Affected
WSO2
Search vendor "WSO2"
WSO2 Identity Server As Key Manager
Search vendor "WSO2" for product "WSO2 Identity Server As Key Manager"
>= 5.6.0.0 < 5.6.0.72
Search vendor "WSO2" for product "WSO2 Identity Server As Key Manager" and version " >= 5.6.0.0 < 5.6.0.72"
en
Affected
WSO2
Search vendor "WSO2"
WSO2 Identity Server As Key Manager
Search vendor "WSO2" for product "WSO2 Identity Server As Key Manager"
>= 5.7.0.0 < 5.7.0.122
Search vendor "WSO2" for product "WSO2 Identity Server As Key Manager" and version " >= 5.7.0.0 < 5.7.0.122"
en
Affected
WSO2
Search vendor "WSO2"
WSO2 Identity Server As Key Manager
Search vendor "WSO2" for product "WSO2 Identity Server As Key Manager"
>= 5.9.0.0 < 5.9.0.165
Search vendor "WSO2" for product "WSO2 Identity Server As Key Manager" and version " >= 5.9.0.0 < 5.9.0.165"
en
Affected
WSO2
Search vendor "WSO2"
WSO2 Identity Server As Key Manager
Search vendor "WSO2" for product "WSO2 Identity Server As Key Manager"
>= 5.10.0.0 < 5.10.0.312
Search vendor "WSO2" for product "WSO2 Identity Server As Key Manager" and version " >= 5.10.0.0 < 5.10.0.312"
en
Affected
WSO2
Search vendor "WSO2"
WSO2 Open Banking KM
Search vendor "WSO2" for product "WSO2 Open Banking KM"
>= 1.3.0.0 < 1.3.0.114
Search vendor "WSO2" for product "WSO2 Open Banking KM" and version " >= 1.3.0.0 < 1.3.0.114"
en
Affected
WSO2
Search vendor "WSO2"
WSO2 Open Banking KM
Search vendor "WSO2" for product "WSO2 Open Banking KM"
>= 1.4.0.0 < 1.4.0.130
Search vendor "WSO2" for product "WSO2 Open Banking KM" and version " >= 1.4.0.0 < 1.4.0.130"
en
Affected
WSO2
Search vendor "WSO2"
WSO2 Open Banking KM
Search vendor "WSO2" for product "WSO2 Open Banking KM"
>= 1.5.0.0 < 1.5.0.120
Search vendor "WSO2" for product "WSO2 Open Banking KM" and version " >= 1.5.0.0 < 1.5.0.120"
en
Affected