--- id: "CVE-2024-4457" kind: "vulnerability" aliases: ["CVE-2024-4457"] title: "The Management Console fails to properly validate input related to the configuration of JDBC user stores" severity: "critical" cvss: 9.1 epss: null exploited: false status: "open" category: "infrastructure" products: [{"name": "WSO2 API Manager", "fixed": ["4.3.0 L21", "4.2.0 L107", "4.1.0 L170", "4.0.0 L308", "3.2.1 L19", "3.2.0 L365"], "affected": "3.2.0, 3.2.1, 4.0.0, 4.1.0, 4.2.0, 4.3.0 below fixed update level", "ecosystem": "vendor"}, {"name": "WSO2 Identity Server", "fixed": ["7.0.0 L15", "6.1.0 L148", "6.0.0 L188", "5.11.0 L336", "5.10.0 L296"], "affected": "5.10.0, 5.11.0, 6.0.0, 6.1.0, 7.0.0 below fixed update level", "ecosystem": "vendor"}, {"name": "WSO2 Enterprise Integrator", "fixed": ["6.6.0 L204"], "affected": "6.6.0 below L204", "ecosystem": "vendor"}] ecosystems: [] tags: ["infrastructure", "management-console", "rce", "self-hosted", "wso2"] not_affected_if: ["auth-required", "managed-hosting", "unknown"] published_at: "2026-10-18T18:16:28+00:00" first_seen_at: "2026-10-23T21:57:17+00:00" updated_at: "2026-10-23T23:26:35+00:00" sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4457", "first_seen_at": "2026-10-23T21:57:17+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:26:35+00:00"}] --- # The Management Console fails to properly validate input related to the configuration of JDBC user stores Management Console input validation flaw in JDBC user store configuration allows RCE (via the embedded H2 engine) as the user running the WSO2 product. Exploitation requires a valid administrator account on the Management Console and network reach to it; WSO2 advises not exposing it publicly. WSO2 rates it Medium (CVSS 6.4), NVD/CNA text reads critical. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:WSO2 API Manager affected 3.2.0, 3.2.1, 4.0.0, 4.1.0, 4.2.0, 4.3.0 below fixed update level fixed 4.3.0 L21, 4.2.0 L107, 4.1.0 L170, 4.0.0 L308, 3.2.1 L19, 3.2.0 L365 - vendor:WSO2 Identity Server affected 5.10.0, 5.11.0, 6.0.0, 6.1.0, 7.0.0 below fixed update level fixed 7.0.0 L15, 6.1.0 L148, 6.0.0 L188, 5.11.0 L336, 5.10.0 L296 - vendor:WSO2 Enterprise Integrator affected 6.6.0 below L204 fixed 6.6.0 L204 ## How to check Identify WSO2 product and version/update level (e.g. via the WSO2 Updates tool or product version in the pack). Affected: API Manager 3.2.0-4.3.0, Enterprise Integrator 6.6.0, Identity Server 5.10.0-7.0.0, IS as Key Manager 5.10.0, Open Banking AM/IAM 2.0.0, if below the update level in the fix. Check whether /carbon Management Console is reachable from untrusted networks. ## Fix Subscribers: update to U2 level API-M 4.3.0 L21, 4.2.0 L107, 4.1.0 L170, 4.0.0 L308, 3.2.1 L19, 3.2.0 L365; EI 6.6.0 L204; IS 7.0.0 L15, 6.1.0 L148, 6.0.0 L188, 5.11.0 L336, 5.10.0 L296; IS-KM 5.10.0 L292; OB AM 2.0.0 L325; OB IAM 2.0.0 L345. Community: apply carbon-kernel PR 4067 or move to latest unaffected release. Restrict Management Console network access. ## Timeline - 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2024-4457 - 2026-10-23T23:26:35+00:00 analyst — Read WSO2 advisory WSO2-2023-3084: needs admin account on Management Console (PR:H, AV:A); WSO2 rates Medium 6.4, not critical. No PoC or exploitation found in search (not checked on X). Fix PR carbon-kernel#4067. ## Documents - [advisory] WSO2-2023-3084 / CVE-2024-4457 https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2023-3084/ - [fix] carbon-kernel PR 4067 (public fix) https://github.com/wso2/carbon-kernel/pull/4067 ## From the sources The Management Console fails to properly validate input related to the configuration of JDBC user stores. This weakness allows an attacker to supply specially crafted input that can lead to the execution of arbitrary code on the affected server. Successful exploitation of this vulnerability enables an attacker to execute arbitrary code on the server with the privileges of the WSO2 product. This could lead to a full compromise of the system. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_