ghsa-j63j-7r7r-5v4j
Vulnerability from github
Published
2025-05-30 15:30
Modified
2025-06-04 23:10
Severity ?
Summary
WSO2 products vulnerable to privilege escalation due to business logic flaw in SOAP admin services
Details
A privilege escalation vulnerability exists in multiple WSO2 products due to a business logic flaw in SOAP admin services. A malicious actor can create a new user with elevated permissions only when all of the following conditions are met: * SOAP admin services are accessible to the attacker. * The deployment includes an internally used attribute that is not part of the default WSO2 product configuration. * At least one custom role exists with non-default permissions. * The attacker has knowledge of the custom role and the internal attribute used in the deployment.
Exploiting this vulnerability allows malicious actors to assign higher privileges to self-registered users, bypassing intended access control mechanisms.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 4.3.0"
},
"package": {
"ecosystem": "Maven",
"name": "org.wso2.am:am-parent"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "4.4.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 7.0.0"
},
"package": {
"ecosystem": "Maven",
"name": "org.wso2.is:identity-server-parent"
},
"ranges": [
{
"events": [
{
"introduced": "5.2.0"
},
{
"fixed": "7.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-7096"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2025-06-04T23:09:07Z",
"nvd_published_at": "2025-05-30T15:15:40Z",
"severity": "MODERATE"
},
"details": "A privilege escalation vulnerability exists in multiple WSO2 products due to a business logic flaw in SOAP admin services. A malicious actor can create a new user with elevated permissions only when all of the following conditions are met:\n * SOAP admin services are accessible to the attacker.\n * The deployment includes an internally used attribute that is not part of the default WSO2 product configuration.\n * At least one custom role exists with non-default permissions.\n * The attacker has knowledge of the custom role and the internal attribute used in the deployment.\n\n\nExploiting this vulnerability allows malicious actors to assign higher privileges to self-registered users, bypassing intended access control mechanisms.",
"id": "GHSA-j63j-7r7r-5v4j",
"modified": "2025-06-04T23:10:09Z",
"published": "2025-05-30T15:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7096"
},
{
"type": "WEB",
"url": "https://github.com/wso2/docs-security/blob/cfd53689909eef62fc5427e193e35e7df8ab1ef8/en/docs/security-announcements/security-advisories/2024/WSO2-2024-3573.md"
},
{
"type": "WEB",
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3573"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "WSO2 products vulnerable to privilege escalation due to business logic flaw in SOAP admin services"
}
Loading...
Loading...
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.