CVE-2024-7096
Privilege Escalation in Multiple WSO2 Products via SOAP Admin Service Due to Business Logic Flaw
- Published
- Updated
- Reserved
- Assigned by
- WSO2
Description
A privilege escalation vulnerability exists in multiple WSO2 products due to a business logic flaw in SOAP admin services. A malicious actor can create a new user with elevated permissions only when all of the following conditions are met: * SOAP admin services are accessible to the attacker. * The deployment includes an internally used attribute that is not part of the default WSO2 product configuration. * At least one custom role exists with non-default permissions. * The attacker has knowledge of the custom role and the internal attribute used in the deployment. Exploiting this vulnerability allows malicious actors to assign higher privileges to self-registered users, bypassing intended access control mechanisms.
Timeline
ID reserved
By WSO2
- 10 months later
· 10 months later
Published
- 6 months later
· 6 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| WSO2CNA (assigner) | 3.1 | Medium4.2 | CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N |
| NVDNVD · Modified | 3.1 | Medium5.4 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
- EPSS (exploitation in 30 days)
- 0.74% · top 45% of all CVEs (7 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.2.
Weakness
Affected products
- unknown < 2.0.0
- affected 2.0.0 – < 2.0.0.364
- unknown < 1.3.0
- affected 1.3.0 – < 1.3.0.131
- affected 1.4.0 – < 1.4.0.134
- affected 1.5.0 – < 1.5.0.136
- affected 2.0.0 – < 2.0.0.343
- unknown < 2.0.0
- affected 2.0.0 – < 2.0.0.29
- affected 2.1.0 – < 2.1.0.39
- affected 2.2.0 – < 2.2.0.56
- affected 2.5.0 – < 2.5.0.83
- affected 2.6.0 – < 2.6.0.142
- affected 3.0.0 – < 3.0.0.162
- affected 3.1.0 – < 3.1.0.294
- affected 3.2.0 – < 3.2.0.384
- affected 3.2.1 – < 3.2.1.16
- affected 4.0.0 – < 4.0.0.305
- affected 4.1.0 – < 4.1.0.166
- affected 4.2.0 – < 4.2.0.101
- affected 4.3.0 – < 4.3.0.16
WSO2 · WSO2 Enterprise Mobility Manager
- affected 2.2.0 – < 2.2.0.26
- unknown < 5.2.0
- affected 5.2.0 – < 5.2.0.32
- affected 5.3.0 – < 5.3.0.33
- affected 5.4.1 – < 5.4.1.36
- affected 5.5.0 – < 5.5.0.50
- affected 5.6.0 – < 5.6.0.58
- affected 5.7.0 – < 5.7.0.123
- affected 5.8.0 – < 5.8.0.106
- affected 5.9.0 – < 5.9.0.157
- affected 5.10.0 – < 5.10.0.318
- affected 5.11.0 – < 5.11.0.365
- affected 6.0.0 – < 6.0.0.209
- affected 6.1.0 – < 6.1.0.188
- affected 7.0.0 – < 7.0.0.60
WSO2 · WSO2 Identity Server as Key Manager
- unknown < 5.3.0
- affected 5.3.0 – < 5.3.0.38
- affected 5.5.0 – < 5.5.0.51
- affected 5.6.0 – < 5.6.0.72
- affected 5.7.0 – < 5.7.0.122
- affected 5.9.0 – < 5.9.0.165
- affected 5.10.0 – < 5.10.0.312
- unknown < 1.3.0
- affected 1.3.0 – < 1.3.0.114
- affected 1.4.0 – < 1.4.0.130
- affected 1.5.0 – < 1.5.0.120
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- Mavenorg.wso2.am:am-parentGHSA-j63j-7r7r-5v4j (opens in a new tab)
- Mavenorg.wso2.is:identity-server-parentGHSA-j63j-7r7r-5v4j (opens in a new tab)
What to do
Solution: Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3... https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3573/#solution
References (1)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-j63j-7r7r-5v4j (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2024-7096)Record last updated .