Arbitrary File Upload Vulnerability in WSO2 Products
CVE-2024-7074

6.8MEDIUM

Key Information:

Vendor

Wso2

Status
Wso2 Enterprise Integrator
Wso2 Api Manager
Wso2 Enterprise Service Bus
Wso2 Enterprise Mobility Manager
Vendor
CVE Published:
2 June 2025

What is CVE-2024-7074?

An arbitrary file upload vulnerability exists in various WSO2 products due to inadequate validation of user inputs in SOAP admin services. This flaw enables authenticated administrators to upload arbitrary files to locations on the server that are under their control. A malicious actor with legitimate admin credentials could exploit this vulnerability to upload specially crafted payloads, potentially leading to remote code execution on the affected server. While exploitation is limited to users with admin access, this vulnerability poses significant risks to the integrity and security of the system.

Affected Version(s)

WSO2 API Manager 2.0.0 < 2.0.0.28

WSO2 API Manager 2.1.0 < 2.1.0.38

WSO2 API Manager 2.2.0 < 2.2.0.57

References

https://security.docs.wso2.com/en/latest/security-announc...
vendor-advisory

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Anonymous working with Trend Micro Zero Day Initiative
.
CVE-2024-7074 : Arbitrary File Upload Vulnerability in WSO2 Products