Skip to content
Fencer Vulns
medium 6.8

CVE-2024-7074 json

Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Service Leading to Remote Code Execution

published 2025-06-02 17 mo ago modified 2026-06-17 4 mo ago also EUVD-2024-54628

cvss
6.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
17.7%
EPSS 17.7% chance of exploitation in 30 days, percentile 97%
public exploits
0
none known

Summary

An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user input in SOAP admin services. A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location on the server.

By leveraging this vulnerability, an attacker could upload a specially crafted payload, potentially achieving remote code execution (RCE) on the server. Exploitation requires valid admin credentials, limiting its impact to authorized but potentially malicious users.

Patch / fix

  • WSO2 WSO2 Enterprise Integrator 6.0.0.21, 6.1.0.38, 6.1.1.42, 6.2.0.61, 6.3.0.69, 6.4.0.96, 6.5.0.102, 6.6.0.198
  • WSO2 WSO2 API Manager 2.0.0.28, 2.1.0.38, 2.2.0.57, 2.5.0.83, 2.6.0.143, 3.0.0.162, 3.1.0.293, 3.2.0.384, 3.2.1.16, 4.0.0.305, 4.1.0.166, 4.2.0.100, 4.3.0.16
  • WSO2 WSO2 Enterprise Service Bus 4.9.0.10, 5.0.0.28
  • WSO2 WSO2 Enterprise Mobility Manager 2.2.0.27
  • WSO2 WSO2 Micro Integrator 1.0.0.49
  • WSO2 WSO2 Open Banking AM 1.3.0.132, 1.4.0.135, 1.5.0.137, 2.0.0.342
  • WSO2 WSO2 Carbon Synapse Artifact Uploader BE 4.4.10.3, 4.6.1.4, 4.6.6.9, 4.6.10.4, 4.6.16.2, 4.6.19.10, 4.6.64.2, 4.6.67.15, 4.6.89.12, 4.6.105.59, 4.6.150.11, 4.7.20.5, 4.7.30.42, 4.7.35.5, 4.7.61.56, 4.7.99.299, 4.7.131.15, 4.7.175.18, 4.7.188.5, 4.7.204.5

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
17 mo ago

Exploit prediction

17.71% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.8 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

  • WSO2 WSO2 Enterprise Integrator
  • WSO2 WSO2 API Manager
  • WSO2 WSO2 Enterprise Service Bus
  • WSO2 WSO2 Enterprise Mobility Manager
  • WSO2 WSO2 Micro Integrator
  • WSO2 WSO2 Open Banking AM
  • WSO2 WSO2 Carbon Synapse Artifact Uploader BE

Classification

Weakness
  • CWE-434 Unrestricted Upload of File with Dangerous Type

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.