{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-7096", "assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "state": "PUBLISHED", "assignerShortName": "WSO2", "dateReserved": "2024-07-25T06:35:14.323Z", "datePublished": "2025-05-30T14:54:32.417Z", "dateUpdated": "2025-05-30T15:01:40.977Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "WSO2 Open Banking IAM", "vendor": "WSO2", "versions": [{"lessThan": "2.0.0", "status": "unknown", "version": "0", "versionType": "custom"}, {"lessThan": "2.0.0.364", "status": "affected", "version": "2.0.0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "WSO2 Open Banking AM", "vendor": "WSO2", "versions": [{"lessThan": "1.3.0", "status": "unknown", "version": "0", "versionType": "custom"}, {"lessThan": "1.3.0.131", "status": "affected", "version": "1.3.0", "versionType": "custom"}, {"lessThan": "1.4.0.134", "status": "affected", "version": "1.4.0", "versionType": "custom"}, {"lessThan": "1.5.0.136", "status": "affected", "version": "1.5.0", "versionType": "custom"}, {"lessThan": "2.0.0.343", "status": "affected", "version": "2.0.0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "WSO2 API Manager", "vendor": "WSO2", "versions": [{"lessThan": "2.0.0", "status": "unknown", "version": "0", "versionType": "custom"}, {"lessThan": "2.0.0.29", "status": "affected", "version": "2.0.0", "versionType": "custom"}, {"lessThan": "2.1.0.39", "status": "affected", "version": "2.1.0", "versionType": "custom"}, {"lessThan": "2.2.0.56", "status": "affected", "version": "2.2.0", "versionType": "custom"}, {"lessThan": "2.5.0.83", "status": "affected", "version": "2.5.0", "versionType": "custom"}, {"lessThan": "2.6.0.142", "status": "affected", "version": "2.6.0", "versionType": "custom"}, {"lessThan": "3.0.0.162", "status": "affected", "version": "3.0.0", "versionType": "custom"}, {"lessThan": "3.1.0.294", "status": "affected", "version": "3.1.0", "versionType": "custom"}, {"lessThan": "3.2.0.384", "status": "affected", "version": "3.2.0", "versionType": "custom"}, {"lessThan": "3.2.1.16", "status": "affected", "version": "3.2.1", "versionType": "custom"}, {"lessThan": "4.0.0.305", "status": "affected", "version": "4.0.0", "versionType": "custom"}, {"lessThan": "4.1.0.166", "status": "affected", "version": "4.1.0", "versionType": "custom"}, {"lessThan": "4.2.0.101", "status": "affected", "version": "4.2.0", "versionType": "custom"}, {"lessThan": "4.3.0.16", "status": "affected", "version": "4.3.0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "WSO2 Enterprise Mobility Manager", "vendor": "WSO2", "versions": [{"lessThan": "2.2.0.26", "status": "affected", "version": "2.2.0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "WSO2 Identity Server", "vendor": "WSO2", "versions": [{"lessThan": "5.2.0", "status": "unknown", "version": "0", "versionType": "custom"}, {"lessThan": "5.2.0.32", "status": "affected", "version": "5.2.0", "versionType": "custom"}, {"lessThan": "5.3.0.33", "status": "affected", "version": "5.3.0", "versionType": "custom"}, {"lessThan": "5.4.1.36", "status": "affected", "version": "5.4.1", "versionType": "custom"}, {"lessThan": "5.5.0.50", "status": "affected", "version": "5.5.0", "versionType": "custom"}, {"lessThan": "5.6.0.58", "status": "affected", "version": "5.6.0", "versionType": "custom"}, {"lessThan": "5.7.0.123", "status": "affected", "version": "5.7.0", "versionType": "custom"}, {"lessThan": "5.8.0.106", "status": "affected", "version": "5.8.0", "versionType": "custom"}, {"lessThan": "5.9.0.157", "status": "affected", "version": "5.9.0", "versionType": "custom"}, {"lessThan": "5.10.0.318", "status": "affected", "version": "5.10.0", "versionType": "custom"}, {"lessThan": "5.11.0.365", "status": "affected", "version": "5.11.0", "versionType": "custom"}, {"lessThan": "6.0.0.209", "status": "affected", "version": "6.0.0", "versionType": "custom"}, {"lessThan": "6.1.0.188", "status": "affected", "version": "6.1.0", "versionType": "custom"}, {"lessThan": "7.0.0.60", "status": "affected", "version": "7.0.0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "WSO2 Identity Server as Key Manager", "vendor": "WSO2", "versions": [{"lessThan": "5.3.0", "status": "unknown", "version": "0", "versionType": "custom"}, {"lessThan": "5.3.0.38", "status": "affected", "version": "5.3.0", "versionType": "custom"}, {"lessThan": "5.5.0.51", "status": "affected", "version": "5.5.0", "versionType": "custom"}, {"lessThan": "5.6.0.72", "status": "affected", "version": "5.6.0", "versionType": "custom"}, {"lessThan": "5.7.0.122", "status": "affected", "version": "5.7.0", "versionType": "custom"}, {"lessThan": "5.9.0.165", "status": "affected", "version": "5.9.0", "versionType": "custom"}, {"lessThan": "5.10.0.312", "status": "affected", "version": "5.10.0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "WSO2 Open Banking KM", "vendor": "WSO2", "versions": [{"lessThan": "1.3.0", "status": "unknown", "version": "0", "versionType": "custom"}, {"lessThan": "1.3.0.114", "status": "affected", "version": "1.3.0", "versionType": "custom"}, {"lessThan": "1.4.0.130", "status": "affected", "version": "1.4.0", "versionType": "custom"}, {"lessThan": "1.5.0.120", "status": "affected", "version": "1.5.0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "A privilege escalation vulnerability exists in multiple [Vendor Name] products due to a business logic flaw in SOAP admin services. A malicious actor can create a new user with elevated permissions <b>only when all of the following conditions are met</b>:<br><ul><li>SOAP admin services are accessible to the attacker.</li><li>The deployment includes an internally used attribute that is not part of the default WSO2 product configuration.</li><li>At least one custom role exists with non-default permissions.</li><li>The attacker has knowledge of the custom role and the internal attribute used in the deployment.</li></ul>Exploiting this vulnerability allows malicious actors to assign higher privileges to self-registered users, bypassing intended access control mechanisms.<br>"}], "value": "A privilege escalation vulnerability exists in multiple [Vendor Name] products due to a business logic flaw in SOAP admin services. A malicious actor can create a new user with elevated permissions only when all of the following conditions are met:\n * SOAP admin services are accessible to the attacker.\n * The deployment includes an internally used attribute that is not part of the default WSO2 product configuration.\n * At least one custom role exists with non-default permissions.\n * The attacker has knowledge of the custom role and the internal attribute used in the deployment.\n\n\nExploiting this vulnerability allows malicious actors to assign higher privileges to self-registered users, bypassing intended access control mechanisms."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "shortName": "WSO2", "dateUpdated": "2025-05-30T15:00:56.617Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3573/"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Follow the instructions given on <a target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3573/#solution\">https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3...</a> <br>"}], "value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3... https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3573/#solution"}], "source": {"advisory": "WSO2-2024-3573", "discovery": "INTERNAL"}, "title": "Privilege Escalation in Multiple WSO2 Products via SOAP Admin Service Due to Business Logic Flaw", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-05-30T15:01:23.580052Z", "id": "CVE-2024-7096", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-30T15:01:40.977Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-7096", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-05-30T15:01:23.580052Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-30T15:01:27.920Z"}}], "cna": {"title": "Privilege Escalation in Multiple WSO2 Products via SOAP Admin Service Due to Business Logic Flaw", "source": {"advisory": "WSO2-2024-3573", "discovery": "INTERNAL"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.2, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "WSO2", "product": "WSO2 Open Banking IAM", "versions": [{"status": "unknown", "version": "0", "lessThan": "2.0.0", "versionType": "custom"}, {"status": "affected", "version": "2.0.0", "lessThan": "2.0.0.364", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Open Banking AM", "versions": [{"status": "unknown", "version": "0", "lessThan": "1.3.0", "versionType": "custom"}, {"status": "affected", "version": "1.3.0", "lessThan": "1.3.0.131", "versionType": "custom"}, {"status": "affected", "version": "1.4.0", "lessThan": "1.4.0.134", "versionType": "custom"}, {"status": "affected", "version": "1.5.0", "lessThan": "1.5.0.136", "versionType": "custom"}, {"status": "affected", "version": "2.0.0", "lessThan": "2.0.0.343", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 API Manager", "versions": [{"status": "unknown", "version": "0", "lessThan": "2.0.0", "versionType": "custom"}, {"status": "affected", "version": "2.0.0", "lessThan": "2.0.0.29", "versionType": "custom"}, {"status": "affected", "version": "2.1.0", "lessThan": "2.1.0.39", "versionType": "custom"}, {"status": "affected", "version": "2.2.0", "lessThan": "2.2.0.56", "versionType": "custom"}, {"status": "affected", "version": "2.5.0", "lessThan": "2.5.0.83", "versionType": "custom"}, {"status": "affected", "version": "2.6.0", "lessThan": "2.6.0.142", "versionType": "custom"}, {"status": "affected", "version": "3.0.0", "lessThan": "3.0.0.162", "versionType": "custom"}, {"status": "affected", "version": "3.1.0", "lessThan": "3.1.0.294", "versionType": "custom"}, {"status": "affected", "version": "3.2.0", "lessThan": "3.2.0.384", "versionType": "custom"}, {"status": "affected", "version": "3.2.1", "lessThan": "3.2.1.16", "versionType": "custom"}, {"status": "affected", "version": "4.0.0", "lessThan": "4.0.0.305", "versionType": "custom"}, {"status": "affected", "version": "4.1.0", "lessThan": "4.1.0.166", "versionType": "custom"}, {"status": "affected", "version": "4.2.0", "lessThan": "4.2.0.101", "versionType": "custom"}, {"status": "affected", "version": "4.3.0", "lessThan": "4.3.0.16", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Enterprise Mobility Manager", "versions": [{"status": "affected", "version": "2.2.0", "lessThan": "2.2.0.26", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "WSO2", "product": "WSO2 Identity Server", "versions": [{"status": "unknown", "version": "0", "lessThan": "5.2.0", "versionType": "custom"}, {"status": "affected", "version": "5.2.0", "lessThan": "5.2.0.32", "versionType": "custom"}, {"status": "affected", "version": "5.3.0", "lessThan": "5.3.0.33", "versionType": "custom"}, {"status": "affected", "version": "5.4.1", "lessThan": "5.4.1.36", "versionType": "custom"}, {"status": "affected", "version": "5.5.0", "lessThan": "5.5.0.50", "versionType": "custom"}, {"status": "affected", "version": "5.6.0", "lessThan": "5.6.0.58", "versionType": "custom"}, {"status": "affected", "version": "5.7.0", "lessThan": "5.7.0.123", "versionType": "custom"}, {"status": "affected", "version": "5.8.0", "lessThan": "5.8.0.106", "versionType": "custom"}, {"status": "affected", "version": "5.9.0", "lessThan": "5.9.0.157", "versionType": "custom"}, {"status": "affected", "version": "5.10.0", "lessThan": "5.10.0.318", "versionType": "custom"}, {"status": "affected", "version": "5.11.0", "lessThan": "5.11.0.365", "versionType": "custom"}, {"status": "affected", "version": "6.0.0", "lessThan": "6.0.0.209", "versionType": "custom"}, {"status": "affected", "version": "6.1.0", "lessThan": "6.1.0.188", "versionType": "custom"}, {"status": "affected", "version": "7.0.0", "lessThan": "7.0.0.60", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Identity Server as Key Manager", "versions": [{"status": "unknown", "version": "0", "lessThan": "5.3.0", "versionType": "custom"}, {"status": "affected", "version": "5.3.0", "lessThan": "5.3.0.38", "versionType": "custom"}, {"status": "affected", "version": "5.5.0", "lessThan": "5.5.0.51", "versionType": "custom"}, {"status": "affected", "version": "5.6.0", "lessThan": "5.6.0.72", "versionType": "custom"}, {"status": "affected", "version": "5.7.0", "lessThan": "5.7.0.122", "versionType": "custom"}, {"status": "affected", "version": "5.9.0", "lessThan": "5.9.0.165", "versionType": "custom"}, {"status": "affected", "version": "5.10.0", "lessThan": "5.10.0.312", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Open Banking KM", "versions": [{"status": "unknown", "version": "0", "lessThan": "1.3.0", "versionType": "custom"}, {"status": "affected", "version": "1.3.0", "lessThan": "1.3.0.114", "versionType": "custom"}, {"status": "affected", "version": "1.4.0", "lessThan": "1.4.0.130", "versionType": "custom"}, {"status": "affected", "version": "1.5.0", "lessThan": "1.5.0.120", "versionType": "custom"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3... https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3573/#solution", "supportingMedia": [{"type": "text/html", "value": "Follow the instructions given on <a target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3573/#solution\">https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3...</a> <br>", "base64": false}]}], "references": [{"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3573/", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "A privilege escalation vulnerability exists in multiple [Vendor Name] products due to a business logic flaw in SOAP admin services. A malicious actor can create a new user with elevated permissions only when all of the following conditions are met:\n * SOAP admin services are accessible to the attacker.\n * The deployment includes an internally used attribute that is not part of the default WSO2 product configuration.\n * At least one custom role exists with non-default permissions.\n * The attacker has knowledge of the custom role and the internal attribute used in the deployment.\n\n\nExploiting this vulnerability allows malicious actors to assign higher privileges to self-registered users, bypassing intended access control mechanisms.", "supportingMedia": [{"type": "text/html", "value": "A privilege escalation vulnerability exists in multiple [Vendor Name] products due to a business logic flaw in SOAP admin services. A malicious actor can create a new user with elevated permissions <b>only when all of the following conditions are met</b>:<br><ul><li>SOAP admin services are accessible to the attacker.</li><li>The deployment includes an internally used attribute that is not part of the default WSO2 product configuration.</li><li>At least one custom role exists with non-default permissions.</li><li>The attacker has knowledge of the custom role and the internal attribute used in the deployment.</li></ul>Exploiting this vulnerability allows malicious actors to assign higher privileges to self-registered users, bypassing intended access control mechanisms.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization"}]}], "providerMetadata": {"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "shortName": "WSO2", "dateUpdated": "2025-05-30T15:00:56.617Z"}}}, "cveMetadata": {"cveId": "CVE-2024-7096", "state": "PUBLISHED", "dateUpdated": "2025-05-30T15:01:40.977Z", "dateReserved": "2024-07-25T06:35:14.323Z", "assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "datePublished": "2025-05-30T14:54:32.417Z", "assignerShortName": "WSO2"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wso2:api_manager:2.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "C6D7E912-B0C4-4AD2-90CF-6355BA9DEEB0", "vulnerable": true}, {"criteria": "cpe:2.3:a:wso2:api_manager:2.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "245D4EB1-F69D-4FAF-94DB-F4B3D3C20539", "vulnerable": true}, {"criteria": "cpe:2.3:a:wso2:api_manager:2.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "6819491F-C6C3-41C1-B27A-0D0B62224977", "vulnerable": true}, {"criteria": "cpe:2.3:a:wso2:api_manager:2.5.0:*:*:*:*:*:*:*", "matchCriteriaId": "0D57C8CF-084D-4142-9AF1-7C9F1261A3BD", "vulnerable": true}, {"criteria": "cpe:2.3:a:wso2:api_manager:2.6.0:*:*:*:*:*:*:*", "matchCriteriaId": "BC168B6A-B15A-4C3B-A38D-C0B65F24F333", "vulnerable": true}, {"criteria": "cpe:2.3:a:wso2:api_manager:3.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "8FF14774-8935-4FC9-B5C8-9771B3D6EBFD", "vulnerable": true}, {"criteria": "cpe:2.3:a:wso2:api_manager:3.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "1344FB79-0796-445C-A8F3-C03E995925D1", "vulnerable": true}, {"criteria": "cpe:2.3:a:wso2:api_manager:3.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "E31E32CD-497E-4EF5-B3FC-8718EE06EDAD", "vulnerable": true}, {"criteria": "cpe:2.3:a:wso2:api_manager:3.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "B58251E8-606B-47C8-8E50-9F9FC8C179BD", "vulnerable": true}, {"criteria": "cpe:2.3:a:wso2:api_manager:4.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "E21D7ABF-C328-425D-B914-618C7628220B", "vulnerable": true}, {"criteria": "cpe:2.3:a:wso2:api_manager:4.1.0:-:*:*:*:*:*:*", "matchCriteriaId": "51465410-6B7C-40FD-A1AB-A14F650A6AC8", "vulnerable": true}, {"criteria": "cpe:2.3:a:wso2:api_manager:4.2.0:-:*:*:*:*:*:*", "matchCriteriaId": "851470CC-22AB-43E4-9CC6-5E22D49B3572", "vulnerable": true}, {"criteria": "cpe:2.3:a:wso2:api_manager:4.3.0:-:*:*:*:*:*:*", "matchCriteriaId": "9EBAB99E-6F0F-4CE9-A954-E8878826304C", "vulnerable": true}, {"criteria": "cpe:2.3:a:wso2:identity_server:5.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "2689AF3E-01AA-4B79-BA55-6BB3D81E16CF", "vulnerable": true}, {"criteria": "cpe:2.3:a:wso2:identity_server:5.3.0:*:*:*:*:*:*:*", "matchCriteriaId": "0375C318-ECD2-4657-A0D7-4A0708266FBE", "vulnerable": true}, {"criteria": "cpe:2.3:a:wso2:identity_server:5.4.0:*:*:*:*:*:*:*", "matchCriteriaId": "B9E7D773-A7CE-4AB8-828B-C2E7DC2799AD", "vulnerable": true}, {"criteria": "cpe:2.3:a:wso2:identity_server:5.4.1:*:*:*:*:*:*:*", "matchCriteriaId": "CEA63B98-D4B4-4FCD-A869-FE64BC21A1B6", "vulnerable": true}, {"criteria": "cpe:2.3:a:wso2:identity_server:5.5.0:*:*:*:*:*:*:*", "matchCriteriaId": "8DA0050E-D5DD-45E5-9F61-DC1BB060EFF0", "vulnerable": true}, {"criteria": "cpe:2.3:a:wso2:identity_server:5.6.0:*:*:*:*:*:*:*", "matchCriteriaId": "26542F95-73F3-4906-838E-A66F5DC9DFA5", "vulnerable": true}, {"criteria": "cpe:2.3:a:wso2:identity_server:5.7.0:*:*:*:*:*:*:*", "matchCriteriaId": "60781FE4-38A3-4FEA-9D8B-CADE4B535974", "vulnerable": true}, {"criteria": "cpe:2.3:a:wso2:identity_server:5.8.0:*:*:*:*:*:*:*", "matchCriteriaId": "2B169832-A746-49A6-8E92-06624AA9B13A", "vulnerable": true}, {"criteria": "cpe:2.3:a:wso2:identity_server:5.9.0:*:*:*:*:*:*:*", "matchCriteriaId": "981D701D-E381-484A-9614-CD0EF0331071", "vulnerable": true}, {"criteria": "cpe:2.3:a:wso2:identity_server:5.10.0:*:*:*:*:*:*:*", "matchCriteriaId": "F4F126CA-A2F9-44F4-968B-DF71765869E5", "vulnerable": true}, {"criteria": "cpe:2.3:a:wso2:identity_server:5.11.0:*:*:*:*:*:*:*", "matchCriteriaId": "2153AECE-020A-4C01-B2A6-F9F5D98E7EBE", "vulnerable": true}, {"criteria": "cpe:2.3:a:wso2:identity_server:6.0.0:-:*:*:*:*:*:*", "matchCriteriaId": "32CE7893-AD1A-49E5-BD1A-5E9C2DEB8764", "vulnerable": true}, {"criteria": "cpe:2.3:a:wso2:identity_server:6.1.0:-:*:*:*:*:*:*", "matchCriteriaId": "EA76533A-5BED-4BDC-B348-EB3D3FDFB110", "vulnerable": true}, {"criteria": "cpe:2.3:a:wso2:identity_server:7.0.0:-:*:*:*:*:*:*", "matchCriteriaId": "C1EFBD0F-9664-4EF3-9908-C72B1318F68F", "vulnerable": true}, {"criteria": "cpe:2.3:a:wso2:identity_server_as_key_manager:5.3.0:*:*:*:*:*:*:*", "matchCriteriaId": "104DBA04-538E-4CC5-9B6C-CFEDB40375AA", "vulnerable": true}, {"criteria": "cpe:2.3:a:wso2:identity_server_as_key_manager:5.5.0:*:*:*:*:*:*:*", "matchCriteriaId": "E4F0F121-700C-4D30-BAFC-960DCC56F08B", "vulnerable": true}, {"criteria": "cpe:2.3:a:wso2:identity_server_as_key_manager:5.6.0:*:*:*:*:*:*:*", "matchCriteriaId": "2E5761F7-C287-4EC4-A899-C54FB4E80A35", "vulnerable": true}, {"criteria": "cpe:2.3:a:wso2:identity_server_as_key_manager:5.7.0:*:*:*:*:*:*:*", "matchCriteriaId": "3B184BFC-8E1A-4971-B6D2-C594742AB8CE", "vulnerable": true}, {"criteria": "cpe:2.3:a:wso2:identity_server_as_key_manager:5.9.0:*:*:*:*:*:*:*", "matchCriteriaId": "EA51AC1B-0BF6-44F6-B034-CAD4F623DD76", "vulnerable": true}, {"criteria": "cpe:2.3:a:wso2:identity_server_as_key_manager:5.10.0:*:*:*:*:*:*:*", "matchCriteriaId": "6BB34405-A2F1-461A-B51B-E103BB3680A1", "vulnerable": true}, {"criteria": "cpe:2.3:a:wso2:open_banking_am:1.3.0:*:*:*:*:*:*:*", "matchCriteriaId": "25CB9F8F-1447-4A54-B82A-FD3278A31FB5", "vulnerable": true}, {"criteria": "cpe:2.3:a:wso2:open_banking_am:1.4.0:*:*:*:*:*:*:*", "matchCriteriaId": "8CFB56F4-91D1-4FBF-842A-04BB117CAF85", "vulnerable": true}, {"criteria": "cpe:2.3:a:wso2:open_banking_am:1.5.0:*:*:*:*:*:*:*", "matchCriteriaId": "035BF3B3-1AB9-43BC-BB37-68843818EDEA", "vulnerable": true}, {"criteria": "cpe:2.3:a:wso2:open_banking_am:2.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "94347800-04D2-48C4-ACF0-078A5ACBB063", "vulnerable": true}, {"criteria": "cpe:2.3:a:wso2:open_banking_iam:2.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "D7C241A3-8EA0-41E4-ABF3-21B9D8E7A5BE", "vulnerable": true}, {"criteria": "cpe:2.3:a:wso2:open_banking_km:1.3.0:*:*:*:*:*:*:*", "matchCriteriaId": "6C46039C-BEE5-4338-8004-B5D9A7DEACBD", "vulnerable": true}, {"criteria": "cpe:2.3:a:wso2:open_banking_km:1.4.0:*:*:*:*:*:*:*", "matchCriteriaId": "E53783F4-60C7-4A92-8951-F8FD51170670", "vulnerable": true}, {"criteria": "cpe:2.3:a:wso2:open_banking_km:1.5.0:*:*:*:*:*:*:*", "matchCriteriaId": "535EFD44-F81C-43B2-B595-81429468637F", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A privilege escalation vulnerability exists in multiple [Vendor Name] products due to a business logic flaw in SOAP admin services. A malicious actor can create a new user with elevated permissions only when all of the following conditions are met:\n * SOAP admin services are accessible to the attacker.\n * The deployment includes an internally used attribute that is not part of the default WSO2 product configuration.\n * At least one custom role exists with non-default permissions.\n * The attacker has knowledge of the custom role and the internal attribute used in the deployment.\n\n\nExploiting this vulnerability allows malicious actors to assign higher privileges to self-registered users, bypassing intended access control mechanisms."}, {"lang": "es", "value": "Existe una vulnerabilidad de escalada de privilegios en varios productos [Nombre del proveedor] debido a una falla en la l\u00f3gica de negocio de los servicios de administraci\u00f3n de SOAP. Un agente malicioso puede crear un nuevo usuario con permisos elevados solo cuando se cumplen todas las siguientes condiciones: * El atacante puede acceder a los servicios de administraci\u00f3n de SOAP. * La implementaci\u00f3n incluye un atributo de uso interno que no forma parte de la configuraci\u00f3n predeterminada del producto WSO2. * Existe al menos un rol personalizado con permisos no predeterminados. * El atacante conoce el rol personalizado y el atributo interno utilizado en la implementaci\u00f3n. Aprovechar esta vulnerabilidad permite a los agentes maliciosos asignar mayores privilegios a usuarios registrados autom\u00e1ticamente, evadiendo as\u00ed los mecanismos de control de acceso previstos."}], "id": "CVE-2024-7096", "lastModified": "2025-10-06T13:58:40.593", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 2.5, "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2025-05-30T15:15:40.063", "references": [{"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "tags": ["Vendor Advisory"], "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3573/"}], "sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "type": "Secondary"}]}

{}

{"created": "2025-07-12T22:31:54.969690+00:00", "updated": "2025-07-12T22:31:54.969752+00:00", "vendors": ["wso2", "wso2$PRODUCT$api_manager", "wso2$PRODUCT$enterprise_mobility_manager", "wso2$PRODUCT$identity_server", "wso2$PRODUCT$identity_server_as_key_manager", "wso2$PRODUCT$open_banking_am", "wso2$PRODUCT$open_banking_iam", "wso2$PRODUCT$open_banking_km"]}