p PatchFirst

CVE-2024-4457

CVE-2024-4457 · Remote Code Execution via JDBC User Store Configuration in Multiple WSO2 Products Allows Arbitrary Code Execution

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

The Management Console fails to properly validate input related to the configuration of JDBC user stores. This weakness allows an attacker to supply specially crafted input that can lead to the execution of arbitrary code on the affected server. Successful exploitation of this vulnerability enables an attacker to execute arbitrary code on the server with the privileges of the WSO2 product. This could lead to a full compromise of the system.

CVSS 9.1 · Critical · EPSS 0.4% · Fix available

Published
Updated

Affected products and versions

  • wso2 enterprise integrator

    Versions
    • ≥ 0, < 6.6.0: Unknown (custom)
    • ≥ 6.6.0, < 6.6.0.204: Affected (custom)

    Update to 6.6.0.204

  • wso2 api manager

    Versions
    • ≥ 0, < 3.1.0: Unknown (custom)
    • ≥ 3.1.0, < 3.1.0.275: Affected (custom)
    • ≥ 3.2.0, < 3.2.0.365: Affected (custom)
    • ≥ 3.2.1, < 3.2.1.19: Affected (custom)
    • ≥ 4.0.0, < 4.0.0.308: Affected (custom)
    • ≥ 4.1.0, < 4.1.0.170: Affected (custom)
    • ≥ 4.2.0, < 4.2.0.107: Affected (custom)
    • ≥ 4.3.0, < 4.3.0.21: Affected (custom)

    Update to 3.1.0.275; Update to 3.2.0.365; Update to 3.2.1.19; Update to 4.0.0.308; Update to 4.1.0.170; Update to 4.2.0.107; Update to 4.3.0.21

  • wso2 open banking am

    Versions
    • ≥ 0, < 2.0.0: Unknown (custom)
    • ≥ 2.0.0, < 2.0.0.325: Affected (custom)

    Update to 2.0.0.325

  • wso2 open banking iam

    Versions
    • ≥ 0, < 2.0.0: Unknown (custom)
    • ≥ 2.0.0, < 2.0.0.345: Affected (custom)

    Update to 2.0.0.345

  • wso2 identity server as key manager

    Versions
    • ≥ 0, < 5.10.0: Unknown (custom)
    • ≥ 5.10.0, < 5.10.0.292: Affected (custom)

    Update to 5.10.0.292

  • wso2 identity server

    Versions
    • ≥ 0, < 5.10.0: Unknown (custom)
    • ≥ 5.10.0, < 5.10.0.296: Affected (custom)
    • ≥ 5.11.0, < 5.11.0.336: Affected (custom)
    • ≥ 6.0.0, < 6.0.0.188: Affected (custom)
    • ≥ 6.1.0, < 6.1.0.148: Affected (custom)
    • ≥ 7.0.0, < 7.0.0.15: Affected (custom)

    Update to 5.10.0.296; Update to 5.11.0.336; Update to 6.0.0.188; Update to 6.1.0.148; Update to 7.0.0.15

  • wso2 carbon user manager kernel

    Versions
    • ≥ 4.5.0, < 4.5.0.4: Affected (custom)
    • ≥ 4.5.3, < 4.5.3.34: Affected (custom)
    • ≥ 4.6.0, < 4.6.0.141: Affected (custom)
    • ≥ 4.6.1, < 4.6.1.108: Affected (custom)
    • ≥ 4.6.2, < 4.6.2.610: Affected (custom)
    • ≥ 4.6.3, < 4.6.3.23: Affected (custom)
    • ≥ 4.6.4, < 4.6.4.5: Affected (custom)
    • ≥ 4.7.1, < 4.7.1.51: Affected (custom)
    • ≥ 4.8.1, < 4.8.1.23: Affected (custom)
    • ≥ 4.9.0, < 4.9.0.54: Affected (custom)
    • ≥ 4.9.26, < 4.9.26.13: Affected (custom)
    • ≥ 4.10.9, < 4.10.9.10: Affected (custom)
    • ≥ 4.9.27: Not affected (custom)

    Update to 4.10.9.10; Update to 4.5.0.4; Update to 4.5.3.34; Update to 4.6.0.141; Update to 4.6.1.108; Update to 4.6.2.610; Update to 4.6.3.23; Update to 4.6.4.5; Update to 4.7.1.51; Update to 4.8.1.23; Update to 4.9.0.54; Update to 4.9.26.13

Original sources

Check your server →