CVE-2024-7074
Medium
Description
An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user input in SOAP admin services. A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location on the server. By leveraging this vulnerability, an attacker could upload a specially crafted payload, potentially achieving remote code execution (RCE) on the server. Exploitation requires valid admin credentials, limiting its impact to authorized but potentially malicious users.
SeverityMedium
CVSS6.8
Exploit probability—
ProductWSO2 Enterprise Integrator
PublishedJun 2, 2025
First seenJun 2, 2025
Weakness typeCWE-434Unrestricted upload of dangerous file type
How to fix
Update
- WSO2 WSO2 Enterprise Integrator6.0.0.21, 6.1.0.38, 6.1.1.42, 6.2.0.61, 6.3.0.69, 6.4.0.96, 6.5.0.102, 6.6.0.198 or later
- WSO2 WSO2 API Manager2.0.0.28, 2.1.0.38, 2.2.0.57, 2.5.0.83, 2.6.0.143, 3.0.0.162, 3.1.0.293, 3.2.0.384, 3.2.1.16, 4.0.0.305, 4.1.0.166, 4.2.0.100, 4.3.0.16 or later
- WSO2 WSO2 Enterprise Service Bus4.9.0.10, 5.0.0.28 or later
- WSO2 WSO2 Enterprise Mobility Manager2.2.0.27 or later
- WSO2 WSO2 Micro Integrator1.0.0.49 or later
- WSO2 WSO2 Open Banking AM1.3.0.132, 1.4.0.135, 1.5.0.137, 2.0.0.342 or later
- WSO2 WSO2 Carbon Synapse Artifact Uploader BE4.4.10.3, 4.6.1.4, 4.6.6.9, 4.6.10.4, 4.6.16.2, 4.6.19.10, 4.6.64.2, 4.6.67.15, 4.6.89.12, 4.6.105.59, 4.6.150.11, 4.7.20.5, 4.7.30.42, 4.7.35.5, 4.7.61.56, 4.7.99.299, 4.7.131.15, 4.7.175.18, 4.7.188.5, 4.7.204.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| WSO2 WSO2 Enterprise Integrator | 6.0.0 ≤ v < 6.0.0.21, 6.1.0 ≤ v < 6.1.0.38, 6.1.1 ≤ v < 6.1.1.42, 6.2.0 ≤ v < 6.2.0.61, 6.3.0 ≤ v < 6.3.0.69, 6.4.0 ≤ v < 6.4.0.96, 6.5.0 ≤ v < 6.5.0.102, 6.6.0 ≤ v < 6.6.0.198 | 6.0.0.21, 6.1.0.38, 6.1.1.42, 6.2.0.61, 6.3.0.69, 6.4.0.96, 6.5.0.102, 6.6.0.198 |
| WSO2 WSO2 API Manager | 2.0.0 ≤ v < 2.0.0.28, 2.1.0 ≤ v < 2.1.0.38, 2.2.0 ≤ v < 2.2.0.57, 2.5.0 ≤ v < 2.5.0.83, 2.6.0 ≤ v < 2.6.0.143, 3.0.0 ≤ v < 3.0.0.162, 3.1.0 ≤ v < 3.1.0.293, 3.2.0 ≤ v < 3.2.0.384, 3.2.1 ≤ v < 3.2.1.16, 4.0.0 ≤ v < 4.0.0.305, 4.1.0 ≤ v < 4.1.0.166, 4.2.0 ≤ v < 4.2.0.100, 4.3.0 ≤ v < 4.3.0.16 | 2.0.0.28, 2.1.0.38, 2.2.0.57, 2.5.0.83, 2.6.0.143, 3.0.0.162, 3.1.0.293, 3.2.0.384, 3.2.1.16, 4.0.0.305, 4.1.0.166, 4.2.0.100, 4.3.0.16 |
| WSO2 WSO2 Enterprise Service Bus | 4.9.0 ≤ v < 4.9.0.10, 5.0.0 ≤ v < 5.0.0.28 | 4.9.0.10, 5.0.0.28 |
| WSO2 WSO2 Enterprise Mobility Manager | 2.2.0 ≤ v < 2.2.0.27 | 2.2.0.27 |
| WSO2 WSO2 Micro Integrator | 1.0.0 ≤ v < 1.0.0.49 | 1.0.0.49 |
| WSO2 WSO2 Open Banking AM | 1.3.0 ≤ v < 1.3.0.132, 1.4.0 ≤ v < 1.4.0.135, 1.5.0 ≤ v < 1.5.0.137, 2.0.0 ≤ v < 2.0.0.342 | 1.3.0.132, 1.4.0.135, 1.5.0.137, 2.0.0.342 |
| WSO2 WSO2 Carbon Synapse Artifact Uploader BE | 4.4.10 ≤ v < 4.4.10.3, 4.6.1 ≤ v < 4.6.1.4, 4.6.6 ≤ v < 4.6.6.9, 4.6.10 ≤ v < 4.6.10.4, 4.6.16 ≤ v < 4.6.16.2, 4.6.19 ≤ v < 4.6.19.10, 4.6.64 ≤ v < 4.6.64.2, 4.6.67 ≤ v < 4.6.67.15, 4.6.89 ≤ v < 4.6.89.12, 4.6.105 ≤ v < 4.6.105.59, 4.6.150 ≤ v < 4.6.150.11, 4.7.20 ≤ v < 4.7.20.5, 4.7.30 ≤ v < 4.7.30.42, 4.7.35 ≤ v < 4.7.35.5, 4.7.61 ≤ v < 4.7.61.56, 4.7.99 ≤ v < 4.7.99.299, 4.7.131 ≤ v < 4.7.131.15, 4.7.175 ≤ v < 4.7.175.18, 4.7.188 ≤ v < 4.7.188.5, 4.7.204 ≤ v < 4.7.204.5 | 4.4.10.3, 4.6.1.4, 4.6.6.9, 4.6.10.4, 4.6.16.2, 4.6.19.10, 4.6.64.2, 4.6.67.15, 4.6.89.12, 4.6.105.59, 4.6.150.11, 4.7.20.5, 4.7.30.42, 4.7.35.5, 4.7.61.56, 4.7.99.299, 4.7.131.15, 4.7.175.18, 4.7.188.5, 4.7.204.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.