Authorization Flaw in WSO2 Products Allowing User Account Takeover

CVE-2024-6914

What is CVE-2024-6914?

An authorization flaw exists in various WSO2 products, stemming from a business logic error within the account recovery SOAP admin service. This vulnerability allows malicious actors to manipulate the account recovery process, enabling them to reset passwords for any user account. Such exploitation could lead to complete account takeover, including those accounts possessing elevated privileges. The exposure is primarily through the SOAP admin services available under the '/services' context path. Mitigation efforts, such as restricting access to these services in line with the provided security guidelines, can significantly reduce potential impacts.

References