CVE-2024-7074
Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Service Leading to Remote Code Execution
MEDIUM
6.8
CVSS Score
Published: June 2, 2025 at 04:42 PM UTC
Updated: June 17, 2026 at 08:19 AM UTC
7 products affected across 1 vendorAPI ManagerEnterprise IntegratorOpen Banking Am
Using WSO2 Enterprise Integrator by WSO2?
Get instant alerts when new vulnerabilities affect WSO2 Enterprise Integrator - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM6.8
Exploit prediction
EPSS 17%
SSVC
No known exploit
Description
An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user input in SOAP admin services. A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location on the server. By leveraging this vulnerability, an attacker could upload a specially crafted payload, potentially achieving remote code execution (RCE) on the server. Exploitation requires valid admin credentials, limiting its impact to authorized but potentially malicious users.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
2.0.0 ≤ v < 2.0.0.282.1.0 ≤ v < 2.1.0.382.2.0 ≤ v < 2.2.0.572.5.0 ≤ v < 2.5.0.832.6.0 ≤ v < 2.6.0.1433.0.0 ≤ v < 3.0.0.1623.1.0 ≤ v < 3.1.0.2933.2.0 ≤ v < 3.2.0.3843.2.1 ≤ v < 3.2.1.164.0.0 ≤ v < 4.0.0.3054.1.0 ≤ v < 4.1.0.1664.2.0 ≤ v < 4.2.0.1004.3.0 ≤ v < 4.3.0.162.0.02.1.02.2.02.5.02.6.03.0.03.1.03.2.03.2.14.0.04.1.04.2.04.3.0
Affected range stops below 2.0.0.28, so it looks safe — our inference, not a vendor statement
Affected range stops below 2.1.0.38, so it looks safe — our inference, not a vendor statement
Affected range stops below 2.2.0.57, so it looks safe — our inference, not a vendor statement
Affected range stops below 2.5.0.83, so it looks safe — our inference, not a vendor statement
Affected range stops below 2.6.0.143, so it looks safe — our inference, not a vendor statement
Affected range stops below 3.0.0.162, so it looks safe — our inference, not a vendor statement
Affected range stops below 3.1.0.293, so it looks safe — our inference, not a vendor statement
Affected range stops below 3.2.0.384, so it looks safe — our inference, not a vendor statement
Affected range stops below 3.2.1.16, so it looks safe — our inference, not a vendor statement
Affected range stops below 4.0.0.305, so it looks safe — our inference, not a vendor statement
Affected range stops below 4.1.0.166, so it looks safe — our inference, not a vendor statement
Affected range stops below 4.2.0.100, so it looks safe — our inference, not a vendor statement
Affected range stops below 4.3.0.16, so it looks safe — our inference, not a vendor statement
Vendor states this is fixed in 2.0.0 (unknown)
4.4.10 ≤ v < 4.4.10.34.6.1 ≤ v < 4.6.1.44.6.10 ≤ v < 4.6.10.44.6.105 ≤ v < 4.6.105.594.6.150 ≤ v < 4.6.150.114.6.16 ≤ v < 4.6.16.24.6.19 ≤ v < 4.6.19.104.6.6 ≤ v < 4.6.6.94.6.64 ≤ v < 4.6.64.24.6.67 ≤ v < 4.6.67.154.6.89 ≤ v < 4.6.89.124.7.131 ≤ v < 4.7.131.154.7.175 ≤ v < 4.7.175.184.7.188 ≤ v < 4.7.188.54.7.20 ≤ v < 4.7.20.54.7.204 ≤ v < 4.7.204.54.7.30 ≤ v < 4.7.30.424.7.35 ≤ v < 4.7.35.54.7.61 ≤ v < 4.7.61.564.7.99 ≤ v < 4.7.99.2994.4.104.6.14.6.104.6.1054.6.1504.6.164.6.194.6.64.6.644.6.674.6.894.7.1314.7.1754.7.1884.7.204.7.2044.7.304.7.354.7.614.7.99
Affected range stops below 4.4.10.3, so it looks safe — our inference, not a vendor statement
Affected range stops below 4.6.1.4, so it looks safe — our inference, not a vendor statement
Affected range stops below 4.6.10.4, so it looks safe — our inference, not a vendor statement
Affected range stops below 4.6.105.59, so it looks safe — our inference, not a vendor statement
Affected range stops below 4.6.150.11, so it looks safe — our inference, not a vendor statement
Affected range stops below 4.6.16.2, so it looks safe — our inference, not a vendor statement
Affected range stops below 4.6.19.10, so it looks safe — our inference, not a vendor statement
Affected range stops below 4.6.6.9, so it looks safe — our inference, not a vendor statement
Affected range stops below 4.6.64.2, so it looks safe — our inference, not a vendor statement
Affected range stops below 4.6.67.15, so it looks safe — our inference, not a vendor statement
Affected range stops below 4.6.89.12, so it looks safe — our inference, not a vendor statement
Affected range stops below 4.7.131.15, so it looks safe — our inference, not a vendor statement
Affected range stops below 4.7.175.18, so it looks safe — our inference, not a vendor statement
Affected range stops below 4.7.188.5, so it looks safe — our inference, not a vendor statement
Affected range stops below 4.7.20.5, so it looks safe — our inference, not a vendor statement
Affected range stops below 4.7.204.5, so it looks safe — our inference, not a vendor statement
Vendor states this is fixed in 4.7.216 (unaffected)
Affected range stops below 4.7.30.42, so it looks safe — our inference, not a vendor statement
Affected range stops below 4.7.35.5, so it looks safe — our inference, not a vendor statement
Affected range stops below 4.7.61.56, so it looks safe — our inference, not a vendor statement
Affected range stops below 4.7.99.299, so it looks safe — our inference, not a vendor statement
6.0.0 ≤ v < 6.0.0.216.1.0 ≤ v < 6.1.0.386.1.1 ≤ v < 6.1.1.426.2.0 ≤ v < 6.2.0.616.3.0 ≤ v < 6.3.0.696.4.0 ≤ v < 6.4.0.966.5.0 ≤ v < 6.5.0.1026.6.0 ≤ v < 6.6.0.1986.0.06.1.06.1.16.2.06.3.06.4.06.5.06.6.0
Affected range stops below 6.0.0.21, so it looks safe — our inference, not a vendor statement
Affected range stops below 6.1.0.38, so it looks safe — our inference, not a vendor statement
Affected range stops below 6.1.1.42, so it looks safe — our inference, not a vendor statement
Affected range stops below 6.2.0.61, so it looks safe — our inference, not a vendor statement
Affected range stops below 6.3.0.69, so it looks safe — our inference, not a vendor statement
Affected range stops below 6.4.0.96, so it looks safe — our inference, not a vendor statement
Affected range stops below 6.5.0.102, so it looks safe — our inference, not a vendor statement
Affected range stops below 6.6.0.198, so it looks safe — our inference, not a vendor statement
Vendor states this is fixed in 6.0.0 (unknown)
2.2.0 ≤ v < 2.2.0.272.2.0
Affected range stops below 2.2.0.27, so it looks safe — our inference, not a vendor statement
Affected range stops below 4.9.0.10, so it looks safe — our inference, not a vendor statement
Affected range stops below 5.0.0.28, so it looks safe — our inference, not a vendor statement
1.0.0 ≤ v < 1.0.0.491.0.0
Affected range stops below 1.0.0.49, so it looks safe — our inference, not a vendor statement
Vendor states this is fixed in 1.0.0 (unknown)
1.3.0 ≤ v < 1.3.0.1321.4.0 ≤ v < 1.4.0.1351.5.0 ≤ v < 1.5.0.1372.0.0 ≤ v < 2.0.0.3421.3.01.4.01.5.02.0.0
Affected range stops below 1.3.0.132, so it looks safe — our inference, not a vendor statement
Affected range stops below 1.4.0.135, so it looks safe — our inference, not a vendor statement
Affected range stops below 1.5.0.137, so it looks safe — our inference, not a vendor statement
Affected range stops below 2.0.0.342, so it looks safe — our inference, not a vendor statement
Vendor states this is fixed in 1.3.0 (unknown)
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
Patch and advisory references
References (1)
Vendor Advisory
Source: ed10eef1-636d-4fbe-9993-6890dfa878f8
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2024-3566/SSVC — Action Prioritization
SSVCNo known exploitNot automatableTotal impact
SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.
CVSS
6.8MEDIUMWSO2
- Attack Vector
- ADJACENT_NETWORK
- Complexity
- LOW
- Privileges
- HIGH
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality
- HIGH
- Integrity
- HIGH
- Availability
- HIGH
Vector?
Quick Info
StatusDEFERRED
CWE
CWE-434
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card