Description
An incorrect authorization vulnerability exists in multiple WSO2 products due to a flaw in the SOAP admin service, which allows user account creation regardless of the self-registration configuration settings. This vulnerability enables malicious actors to create new user accounts without proper authorization.
Exploitation of this flaw could allow an attacker to create multiple low-privileged user accounts, gaining unauthorized access to the system. Additionally, continuous exploitation could lead to system resource exhaustion through mass user creation.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| WSO2 | WSO2 Open Banking AM | 1.3.0 – < 1.3.0.131, 1.4.0 – < 1.4.0.134, 1.5.0 – < 1.5.0.136, 2.0.0 – < 2.0.0.343 | 1.3.0.131 |
| WSO2 | WSO2 Open Banking KM | 1.3.0 – < 1.3.0.114, 1.4.0 – < 1.4.0.130, 1.5.0 – < 1.5.0.120 | 1.3.0.114 |
| WSO2 | WSO2 Identity Server as Key Manager | 5.3.0 – < 5.3.0.38, 5.5.0 – < 5.5.0.51, 5.6.0 – < 5.6.0.72, 5.7.0 – < 5.7.0.122, 5.9.0 – < 5.9.0.165, 5.10.0 – < 5.10.0.312 | 5.3.0.38 |
| WSO2 | WSO2 API Manager | 2.0.0 – < 2.0.0.29, 2.1.0 – < 2.1.0.39, 2.2.0 – < 2.2.0.56, 2.5.0 – < 2.5.0.83, 2.6.0 – < 2.6.0.142, 3.0.0 – < 3.0.0.162, 3.1.0 – < 3.1.0.294, 3.2.0 – < 3.2.0.384, 3.2.1 – < 3.2.1.16, 4.0.0 – < 4.0.0.305, 4.1.0 – < 4.1.0.166, 4.2.0 – < 4.2.0.101, 4.3.0 – < 4.3.0.16 | 2.0.0.29 |
| WSO2 | WSO2 Identity Server | 5.2.0 – < 5.2.0.32, 5.3.0 – < 5.3.0.33, 5.4.0 – < 5.4.0.32, 5.4.1 – < 5.4.1.36, 5.5.0 – < 5.5.0.50, 5.6.0 – < 5.6.0.58, 5.7.0 – < 5.7.0.123, 5.8.0 – < 5.8.0.106, 5.9.0 – < 5.9.0.157, 5.10.0 – < 5.10.0.318, 5.11.0 – < 5.11.0.365, 6.0.0 – < 6.0.0.209, 6.1.0 – < 6.1.0.188, 7.0.0 – < 7.0.0.60 | 5.2.0.32 |
| WSO2 | WSO2 Open Banking IAM | 2.0.0 – < 2.0.0.364 | 2.0.0.364 |
| WSO2 | WSO2 Enterprise Mobility Manager | 2.2.0 – < 2.2.0.26 | 2.2.0.26 |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- WSO2 User Registration - Arbitrary Account Creation http/cves/2024/CVE-2024-7097.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.