Riskcovery

CVE-2024-4457

Remote Code Execution via JDBC User Store Configuration in Multiple WSO2 Products Allows Arbitrary Code Execution

State
Published
Severity
9.1 Critical
Published
Oct 18, 2026
Updated
Oct 20, 2026
Reserved
May 3, 2024

Read the record on cve.org

Description

The Management Console fails to properly validate input related to the configuration of JDBC user stores. This weakness allows an attacker to supply specially crafted input that can lead to the execution of arbitrary code on the affected server.

Successful exploitation of this vulnerability enables an attacker to execute arbitrary code on the server with the privileges of the WSO2 product. This could lead to a full compromise of the system.

Scores

CVSSScoreVectorSource
3.19.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NCISA-ADP

Weaknesses

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected Products

ProductVersions
WSO2 Enterprise IntegratorWSO2
  • before 6.6.0Unknown
  • 6.6.0 to before 6.6.0.204Affected
WSO2 API ManagerWSO2
  • before 3.1.0Unknown
  • 3.1.0 to before 3.1.0.275Affected
  • 3.2.0 to before 3.2.0.365Affected
  • 3.2.1 to before 3.2.1.19Affected
  • 4.0.0 to before 4.0.0.308Affected
  • 4.1.0 to before 4.1.0.170Affected
  • 4.2.0 to before 4.2.0.107Affected
  • 4.3.0 to before 4.3.0.21Affected
WSO2 Open Banking AMWSO2
  • before 2.0.0Unknown
  • 2.0.0 to before 2.0.0.325Affected
WSO2 Open Banking IAMWSO2
  • before 2.0.0Unknown
  • 2.0.0 to before 2.0.0.345Affected
WSO2 Identity Server as Key ManagerWSO2
  • before 5.10.0Unknown
  • 5.10.0 to before 5.10.0.292Affected
WSO2 Identity ServerWSO2
  • before 5.10.0Unknown
  • 5.10.0 to before 5.10.0.296Affected
  • 5.11.0 to before 5.11.0.336Affected
  • 6.0.0 to before 6.0.0.188Affected
  • 6.1.0 to before 6.1.0.148Affected
  • 7.0.0 to before 7.0.0.15Affected
WSO2 Carbon User Manager KernelWSO2
  • 4.5.0 to before 4.5.0.4Affected
  • 4.5.3 to before 4.5.3.34Affected
  • 4.6.0 to before 4.6.0.141Affected
  • 4.6.1 to before 4.6.1.108Affected
  • 4.6.2 to before 4.6.2.610Affected
  • 4.6.3 to before 4.6.3.23Affected
  • 4.6.4 to before 4.6.4.5Affected
  • 4.7.1 to before 4.7.1.51Affected
  • 4.8.1 to before 4.8.1.23Affected
  • 4.9.0 to before 4.9.0.54Affected
  • 4.9.26 to before 4.9.26.13Affected
  • 4.10.9 to before 4.10.9.10Affected
  • 4.9.27 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.