Live › vulnerability › CVE-2024-4457
Go to dashboardManagement Console input validation flaw in JDBC user store configuration allows RCE (via the embedded H2 engine) as the user running the WSO2 product. Exploitation requires a valid administrator account on the Management Console and network reach to it; WSO2 advises not exposing it publicly. WSO2 rates it Medium (CVSS 6.4), NVD/CNA text reads critical.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| WSO2 API Manager | vendor | 3.2.0, 3.2.1, 4.0.0, 4.1.0, 4.2.0, 4.3.0 below fixed update level | 4.3.0 L21, 4.2.0 L107, 4.1.0 L170, 4.0.0 L308, 3.2.1 L19, 3.2.0 L365 |
| WSO2 Identity Server | vendor | 5.10.0, 5.11.0, 6.0.0, 6.1.0, 7.0.0 below fixed update level | 7.0.0 L15, 6.1.0 L148, 6.0.0 L188, 5.11.0 L336, 5.10.0 L296 |
| WSO2 Enterprise Integrator | vendor | 6.6.0 below L204 | 6.6.0 L204 |
3.2.0-4.3.0, Enterprise Integrator 6.6.0, Identity Server 5.10.0-7.0.0, IS as Key Manager 5.10.0, Open Banking AM/IAM 2.0.0, if below the update level in the fix4.3.0 L21, 4.2.0 L107, 4.1.0 L170, 4.0.0 L308, 3.2.1 L19, 3.2.0 L365; EI 6.6.0 L204; IS 7.0.0 L15, 6.1.0 L148, 6.0.0 L188, 5.11.0 L336, 5.10.0 L296; IS-KM 5.10.0 L292; OB AM 2.0.0 L325; OB IAM 2.0.0 L345Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Management Console fails to properly validate input related to the configuration of JDBC user stores. This weakness allows an attacker to supply specially crafted input that can lead to the execution of arbitrary code on the affected server.
Successful exploitation of this vulnerability enables an attacker to execute arbitrary code on the server with the privileges of the WSO2 product. This could lead to a full compromise of the system.
This page as .md · .json · in your agent: get_signal("CVE-2024-4457")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.