{"id":"CVE-2024-4457","kind":"vulnerability","aliases":["CVE-2024-4457"],"related":[],"title":"The Management Console fails to properly validate input related to the configuration of JDBC user stores","description":"The Management Console fails to properly validate input related to the configuration of JDBC user stores. This weakness allows an attacker to supply specially crafted input that can lead to the execution of arbitrary code on the affected server.\n\nSuccessful exploitation of this vulnerability enables an attacker to execute arbitrary code on the server with the privileges of the WSO2 product. This could lead to a full compromise of the system.","summary":"Management Console input validation flaw in JDBC user store configuration allows RCE (via the embedded H2 engine) as the user running the WSO2 product. Exploitation requires a valid administrator account on the Management Console and network reach to it; WSO2 advises not exposing it publicly. WSO2 rates it Medium (CVSS 6.4), NVD/CNA text reads critical.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"WSO2 API Manager","fixed":["4.3.0 L21","4.2.0 L107","4.1.0 L170","4.0.0 L308","3.2.1 L19","3.2.0 L365"],"affected":"3.2.0, 3.2.1, 4.0.0, 4.1.0, 4.2.0, 4.3.0 below fixed update level","ecosystem":"vendor"},{"name":"WSO2 Identity Server","fixed":["7.0.0 L15","6.1.0 L148","6.0.0 L188","5.11.0 L336","5.10.0 L296"],"affected":"5.10.0, 5.11.0, 6.0.0, 6.1.0, 7.0.0 below fixed update level","ecosystem":"vendor"},{"name":"WSO2 Enterprise Integrator","fixed":["6.6.0 L204"],"affected":"6.6.0 below L204","ecosystem":"vendor"}],"ecosystems":[],"tags":["infrastructure","management-console","rce","self-hosted","wso2"],"not_affected_if":["auth-required","managed-hosting","unknown"],"how_to_check":"Identify WSO2 product and version/update level (e.g. via the WSO2 Updates tool or product version in the pack). Affected: API Manager 3.2.0-4.3.0, Enterprise Integrator 6.6.0, Identity Server 5.10.0-7.0.0, IS as Key Manager 5.10.0, Open Banking AM/IAM 2.0.0, if below the update level in the fix. Check whether /carbon Management Console is reachable from untrusted networks.","fix":"Subscribers: update to U2 level API-M 4.3.0 L21, 4.2.0 L107, 4.1.0 L170, 4.0.0 L308, 3.2.1 L19, 3.2.0 L365; EI 6.6.0 L204; IS 7.0.0 L15, 6.1.0 L148, 6.0.0 L188, 5.11.0 L336, 5.10.0 L296; IS-KM 5.10.0 L292; OB AM 2.0.0 L325; OB IAM 2.0.0 L345. Community: apply carbon-kernel PR 4067 or move to latest unaffected release. Restrict Management Console network access.","status":"open","published_at":"2026-10-18T18:16:28+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-23T22:13:35+00:00","updated_at":"2026-10-23T23:26:35+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-23T22:13:35Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","impact":"high","summary":"WSO2 Management Console does not validate input used when configuring JDBC user stores. An attacker who sends crafted input can run arbitrary code on the server with the privileges of the WSO2 product, which can lead to full system compromise.","category":"infrastructure","who_cares":["wso2","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary code on the server and fully compromises the system","analyst_note":"Find affected WSO2 product versions and patched releases, and whether the Management Console needs admin login to reach the JDBC user store config, via the NVD entry and WSO2 security advisory for CVE-2024-4457.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000445,"input_tokens":2792,"output_tokens":331,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find affected WSO2 product versions and patched releases, and whether the Management Console needs admin login to reach the JDBC user store config, via the NVD entry and WSO2 security advisory for CVE-2024-4457.","search":"'-2024':18A,21A '-4457':19A,22A '6.4':91B 'account':70B 'administr':69B 'advis':81B 'affect':133C 'allow':51B,114C 'api':24A 'arbitrari':129C,145C 'attack':116C,142C 'code':130C,146C 'compromis':163C 'configur':12A,50B,107C 'consol':3A,35B,42B,74B,98C 'could':158C 'craft':120C 'critic':95B 'cve':17A,20A 'cvss':90B 'embed':55B 'enabl':140C 'engin':57B 'enterprise':30A 'execut':127C,144C 'exploit':65B,136C 'expos':83B 'fail':4A,99C 'flaw':45B 'full':162C 'h2':56B 'host':39B 'identity':27A 'infrastructur':32B 'input':8A,43B,103C,121C 'integrator':31A 'jdbc':14A,47B,109C 'lead':124C,159C 'manag':2A,34B,41B,73B,97C 'management-consol':33B 'manager':25A 'medium':89B 'network':76B 'nvd/cna':92B 'privileg':152C 'product':64B,156C 'proper':6A,101C 'public':85B 'rate':87B 'rce':36B,52B 'reach':77B 'read':94B 'relat':9A,104C 'requir':66B 'run':61B 'self':38B 'self-host':37B 'server':28A,134C,149C 'special':119C 'store':16A,49B,111C 'success':135C 'suppli':118C 'system':166C 'text':93B 'user':15A,48B,60B,110C 'valid':7A,44B,68B,102C 'via':53B 'vulner':139C 'weak':113C 'wso2':23A,26A,29A,40B,63B,80B,86B,155C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T18:16:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2024-4457","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-4457","severity":null,"published_at":"2026-10-18T18:16:28+00:00","modified_at":"2026-10-20T19:17:10+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null},{"source":"analyst","external_id":"CVE-2024-4457:443","url":null,"severity":null,"published_at":"2026-10-23T23:26:35+00:00","modified_at":"2026-10-23T23:26:35+00:00","first_seen_at":"2026-10-23T23:26:35+00:00","fetched_at":"2026-10-23T23:26:35+00:00","note":"Read WSO2 advisory WSO2-2023-3084: needs admin account on Management Console (PR:H, AV:A); WSO2 rates Medium 6.4, not critical. No PoC or exploitation found in search (not checked on X). Fix PR carbon-kernel#4067."}],"documents":[{"id":1960,"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2023-3084/","title":"WSO2-2023-3084 / CVE-2024-4457","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1961,"url":"https://github.com/wso2/carbon-kernel/pull/4067","title":"carbon-kernel PR 4067 (public fix)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}