CVE-2024-4457Published

Remote Code Execution via JDBC User Store Configuration in Multiple WSO2 Products Allows Arbitrary Code Execution

cve-program · CVE-2024-4457

Published

WSO2 Enterprise Integrator

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "WSO2",
                    "product": "WSO2 Enterprise Integrator",
                    "versions": [
                        {
                            "status": "unknown",
                            "version": "0",
                            "lessThan": "6.6.0",
                            "versionType": "custom"
                        },
                        {
                            "status": "affected",
                            "version": "6.6.0",
                            "lessThan": "6.6.0.204",
                            "versionType": "custom"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

WSO2 API Manager

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "WSO2",
                    "product": "WSO2 API Manager",
                    "versions": [
                        {
                            "status": "unknown",
                            "version": "0",
                            "lessThan": "3.1.0",
                            "versionType": "custom"
                        },
                        {
                            "status": "affected",
                            "version": "3.1.0",
                            "lessThan": "3.1.0.275",
                            "versionType": "custom"
                        },
                        {
                            "status": "affected",
                            "version": "3.2.0",
                            "lessThan": "3.2.0.365",
                            "versionType": "custom"
                        },
                        {
                            "status": "affected",
                            "version": "3.2.1",
                            "lessThan": "3.2.1.19",
                            "versionType": "custom"
                        },
                        {
                            "status": "affected",
                            "version": "4.0.0",
                            "lessThan": "4.0.0.308",
                            "versionType": "custom"
                        },
                        {
                            "status": "affected",
                            "version": "4.1.0",
                            "lessThan": "4.1.0.170",
                            "versionType": "custom"
                        },
                        {
                            "status": "affected",
                            "version": "4.2.0",
                            "lessThan": "4.2.0.107",
                            "versionType": "custom"
                        },
                        {
                            "status": "affected",
                            "version": "4.3.0",
                            "lessThan": "4.3.0.21",
                            "versionType": "custom"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

WSO2 Open Banking AM

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "WSO2",
                    "product": "WSO2 Open Banking AM",
                    "versions": [
                        {
                            "status": "unknown",
                            "version": "0",
                            "lessThan": "2.0.0",
                            "versionType": "custom"
                        },
                        {
                            "status": "affected",
                            "version": "2.0.0",
                            "lessThan": "2.0.0.325",
                            "versionType": "custom"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

WSO2 Open Banking IAM

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "WSO2",
                    "product": "WSO2 Open Banking IAM",
                    "versions": [
                        {
                            "status": "unknown",
                            "version": "0",
                            "lessThan": "2.0.0",
                            "versionType": "custom"
                        },
                        {
                            "status": "affected",
                            "version": "2.0.0",
                            "lessThan": "2.0.0.345",
                            "versionType": "custom"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

WSO2 Identity Server as Key Manager

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "WSO2",
                    "product": "WSO2 Identity Server as Key Manager",
                    "versions": [
                        {
                            "status": "unknown",
                            "version": "0",
                            "lessThan": "5.10.0",
                            "versionType": "custom"
                        },
                        {
                            "status": "affected",
                            "version": "5.10.0",
                            "lessThan": "5.10.0.292",
                            "versionType": "custom"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

WSO2 Identity Server

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "WSO2",
                    "product": "WSO2 Identity Server",
                    "versions": [
                        {
                            "status": "unknown",
                            "version": "0",
                            "lessThan": "5.10.0",
                            "versionType": "custom"
                        },
                        {
                            "status": "affected",
                            "version": "5.10.0",
                            "lessThan": "5.10.0.296",
                            "versionType": "custom"
                        },
                        {
                            "status": "affected",
                            "version": "5.11.0",
                            "lessThan": "5.11.0.336",
                            "versionType": "custom"
                        },
                        {
                            "status": "affected",
                            "version": "6.0.0",
                            "lessThan": "6.0.0.188",
                            "versionType": "custom"
                        },
                        {
                            "status": "affected",
                            "version": "6.1.0",
                            "lessThan": "6.1.0.148",
                            "versionType": "custom"
                        },
                        {
                            "status": "affected",
                            "version": "7.0.0",
                            "lessThan": "7.0.0.15",
                            "versionType": "custom"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

org.wso2.carbon:org.wso2.carbon.user.core

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "WSO2",
                    "product": "WSO2 Carbon User Manager Kernel",
                    "packageName": "org.wso2.carbon:org.wso2.carbon.user.core",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "4.5.0",
                            "lessThan": "4.5.0.4",
                            "versionType": "custom"
                        },
                        {
                            "status": "affected",
                            "version": "4.5.3",
                            "lessThan": "4.5.3.34",
                            "versionType": "custom"
                        },
                        {
                            "status": "affected",
                            "version": "4.6.0",
                            "lessThan": "4.6.0.141",
                            "versionType": "custom"
                        },
                        {
                            "status": "affected",
                            "version": "4.6.1",
                            "lessThan": "4.6.1.108",
                            "versionType": "custom"
                        },
                        {
                            "status": "affected",
                            "version": "4.6.2",
                            "lessThan": "4.6.2.610",
                            "versionType": "custom"
                        },
                        {
                            "status": "affected",
                            "version": "4.6.3",
                            "lessThan": "4.6.3.23",
                            "versionType": "custom"
                        },
                        {
                            "status": "affected",
                            "version": "4.6.4",
                            "lessThan": "4.6.4.5",
                            "versionType": "custom"
                        },
                        {
                            "status": "affected",
                            "version": "4.7.1",
                            "lessThan": "4.7.1.51",
                            "versionType": "custom"
                        },
                        {
                            "status": "affected",
                            "version": "4.8.1",
                            "lessThan": "4.8.1.23",
                            "versionType": "custom"
                        },
                        {
                            "status": "affected",
                            "version": "4.9.0",
                            "lessThan": "4.9.0.54",
                            "versionType": "custom"
                        },
                        {
                            "status": "affected",
                            "version": "4.9.26",
                            "lessThan": "4.9.26.13",
                            "versionType": "custom"
                        },
                        {
                            "status": "affected",
                            "version": "4.10.9",
                            "lessThan": "4.10.9.10",
                            "versionType": "custom"
                        },
                        {
                            "status": "unaffected",
                            "version": "4.9.27",
                            "lessThanOrEqual": "*",
                            "versionType": "custom"
                        }
                    ],
                    "defaultStatus": "unknown"
                }

Original source record · Cite this exact observation · Complete original publisher JSON