by Kastro CVE-2024-4457
WSO2 WSO2 Enterprise Integrator — Remote Code Execution via JDBC User Store Configuration in Multiple WSO2 Products Allows Arbitrary Code Execution
Description · from the CVE record
The Management Console fails to properly validate input related to the configuration of JDBC user stores. This weakness allows an attacker to supply specially crafted input that can lead to the execution of arbitrary code on the affected server. Successful exploitation of this vulnerability enables an attacker to execute arbitrary code on the server with the privileges of the WSO2 product. This could lead to a full compromise of the system.
Affected
ProductAffectedFixed inSource
WSO2 Enterprise Integrator6.6.0 – < 6.6.0.2046.6.0.204CNA
WSO2 API Manager3.1.0 – < 3.1.0.2753.1.0.275CNA
WSO2 API Manager3.2.0 – < 3.2.0.3653.2.0.365CNA
WSO2 API Manager3.2.1 – < 3.2.1.193.2.1.19CNA
WSO2 API Manager4.0.0 – < 4.0.0.3084.0.0.308CNA
WSO2 API Manager4.1.0 – < 4.1.0.1704.1.0.170CNA
WSO2 API Manager4.2.0 – < 4.2.0.1074.2.0.107CNA
WSO2 API Manager4.3.0 – < 4.3.0.214.3.0.21CNA
WSO2 Open Banking AM2.0.0 – < 2.0.0.3252.0.0.325CNA
WSO2 Open Banking IAM2.0.0 – < 2.0.0.3452.0.0.345CNA
WSO2 Identity Server as Key Manager5.10.0 – < 5.10.0.2925.10.0.292CNA
WSO2 Identity Server5.10.0 – < 5.10.0.2965.10.0.296CNA
Scores by source
CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total