1. Home
  2. CVE Database
  3. CVE-2024-7096
MEDIUM · 4.2

CVE-2024-7096

A privilege escalation vulnerability exists in multiple WSO2 products due to a business logic flaw in SOAP admin services. A malicious actor can create a new user with elevated permissions only when a...

Vulnerability Description

A privilege escalation vulnerability exists in multiple WSO2 products due to a business logic flaw in SOAP admin services. A malicious actor can create a new user with elevated permissions only when all of the following conditions are met: * SOAP admin services are accessible to the attacker. * The deployment includes an internally used attribute that is not part of the default WSO2 product configuration. * At least one custom role exists with non-default permissions. * The attacker has knowledge of the custom role and the internal attribute used in the deployment. Exploiting this vulnerability allows malicious actors to assign higher privileges to self-registered users, bypassing intended access control mechanisms.

CVSS Score

4.2

MEDIUM

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack Vector
ADJACENT_NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
Wso2Api Manager2.0.0
Wso2Identity Server5.2.0
Wso2Identity Server As Key Manager5.3.0
Wso2Open Banking Am1.3.0
Wso2Open Banking Iam2.0.0
Wso2Open Banking Km1.3.0

Related Weaknesses (CWE)

CWE-863

References

FAQ

What is CVE-2024-7096?

CVE-2024-7096 is a vulnerability with a CVSS score of 4.2 (MEDIUM). A privilege escalation vulnerability exists in multiple WSO2 products due to a business logic flaw in SOAP admin services. A malicious actor can create a new user with elevated permissions only when a...

How severe is CVE-2024-7096?

CVE-2024-7096 has been rated MEDIUM with a CVSS base score of 4.2/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2024-7096?

Check the references section above for vendor advisories and patch information. Affected products include: Wso2 Api Manager, Wso2 Identity Server, Wso2 Identity Server As Key Manager, Wso2 Open Banking Am, Wso2 Open Banking Iam.