CVE-2024-7096 json
Privilege Escalation in Multiple WSO2 Products via SOAP Admin Service Due to Business Logic Flaw
published 2025-05-30 17 mo ago modified 2026-06-17 4 mo ago also GHSA-j63j-7r7r-5v4j , EUVD-2024-54612
- cvss
- 4.2
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 54%
- public exploits
- 0
- none known
Summary
A privilege escalation vulnerability exists in multiple WSO2 products due to a business logic flaw in SOAP admin services. A malicious actor can create a new user with elevated permissions only when all of the following conditions are met: * SOAP admin services are accessible to the attacker. * The deployment includes an internally used attribute that is not part of the default WSO2 product configuration. * At least one custom role exists with non-default permissions. * The attacker has knowledge of the custom role and the internal attribute used in the deployment.
Exploiting this vulnerability allows malicious actors to assign higher privileges to self-registered users, bypassing intended access control mechanisms.
Patch / fix
- maven org.wso2.am:am-parent 4.4.0
- maven org.wso2.is:identity-server-parent 7.1.0
- WSO2 WSO2 Open Banking IAM 2.0.0.364
- WSO2 WSO2 Open Banking AM 1.3.0.131, 1.4.0.134, 1.5.0.136, 2.0.0.343
- WSO2 WSO2 API Manager 2.0.0.29, 2.1.0.39, 2.2.0.56, 2.5.0.83, 2.6.0.142, 3.0.0.162, 3.1.0.294, 3.2.0.384, 3.2.1.16, 4.0.0.305, 4.1.0.166, 4.2.0.101, 4.3.0.16
- WSO2 WSO2 Enterprise Mobility Manager 2.2.0.26
- WSO2 WSO2 Identity Server 5.2.0.32, 5.3.0.33, 5.4.1.36, 5.5.0.50, 5.6.0.58, 5.7.0.123, 5.8.0.106, 5.9.0.157, 5.10.0.318, 5.11.0.365, 6.0.0.209, 6.1.0.188, 7.0.0.60
- WSO2 WSO2 Identity Server as Key Manager 5.3.0.38, 5.5.0.51, 5.6.0.72, 5.7.0.122, 5.9.0.165, 5.10.0.312
- WSO2 WSO2 Open Banking KM 1.3.0.114, 1.4.0.130, 1.5.0.120
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 17 mo ago
Exploit prediction
0.74% chance of exploitation in the next 30 days, higher than 54% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.2 | CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N |
| NVD | 3.1 | 5.4 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
| GitHub | 3.1 | 4.2 | CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.wso2.am:am-parent | >=2.0.0, <4.4.0 |
4.4.0 |
| maven | org.wso2.is:identity-server-parent | >=5.2.0, <7.1.0 |
7.1.0 |
Affected products
- WSO2 WSO2 Open Banking IAM
- WSO2 WSO2 Open Banking AM
- WSO2 WSO2 API Manager
- WSO2 WSO2 Enterprise Mobility Manager
- WSO2 WSO2 Identity Server
- WSO2 WSO2 Identity Server as Key Manager
- WSO2 WSO2 Open Banking KM
Classification
- Weakness
-
- CWE-863 Incorrect Authorization
References
-
security.docs.wso2.com
/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3573/
vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-7096
advisory
-
github.com
/wso2/docs-security/blob/cfd53689909eef62fc5427e193e35e7df8ab1ef8/en/docs/security-announcements/security-advi
web
-
security.docs.wso2.com
/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3573
web
Sources
- CVE List CVE-2024-7096
- GitHub Advisory GHSA-j63j-7r7r-5v4j
- NVD CVE-2024-7096
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.