CVE-2024-7074

Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Service Leading to Remote Code Execution

State: Published
Severity: 6.8 Medium
Published: Jun 2, 2025
Updated: Jun 2, 2025
Reserved: Jul 24, 2024

Description

An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user input in SOAP admin services. A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location on the server.

By leveraging this vulnerability, an attacker could upload a specially crafted payload, potentially achieving remote code execution (RCE) on the server. Exploitation requires valid admin credentials, limiting its impact to authorized but potentially malicious users.

Scores

CVSS	Score	Vector	Source
3.1	6.8 Medium	CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	WSO2

Weaknesses

CWE-434 Unrestricted Upload of File with Dangerous Type

Affected Products

Product	Versions
WSO2 Enterprise IntegratorWSO2	before 6.0.0Unknown 6.0.0 to before 6.0.0.21Affected 6.1.0 to before 6.1.0.38Affected 6.1.1 to before 6.1.1.42Affected 6.2.0 to before 6.2.0.61Affected 6.3.0 to before 6.3.0.69Affected 6.4.0 to before 6.4.0.96Affected 6.5.0 to before 6.5.0.102Affected 6.6.0 to before 6.6.0.198Affected
WSO2 API ManagerWSO2	before 2.0.0Unknown 2.0.0 to before 2.0.0.28Affected 2.1.0 to before 2.1.0.38Affected 2.2.0 to before 2.2.0.57Affected 2.5.0 to before 2.5.0.83Affected 2.6.0 to before 2.6.0.143Affected 3.0.0 to before 3.0.0.162Affected 3.1.0 to before 3.1.0.293Affected 3.2.0 to before 3.2.0.384Affected 3.2.1 to before 3.2.1.16Affected 4.0.0 to before 4.0.0.305Affected 4.1.0 to before 4.1.0.166Affected 4.2.0 to before 4.2.0.100Affected 4.3.0 to before 4.3.0.16Affected
WSO2 Enterprise Service BusWSO2	4.9.0 to before 4.9.0.10Affected 5.0.0 to before 5.0.0.28Affected
WSO2 Enterprise Mobility ManagerWSO2	2.2.0 to before 2.2.0.27Affected
WSO2 Micro IntegratorWSO2	before 1.0.0Unknown 1.0.0 to before 1.0.0.49Affected
WSO2 Open Banking AMWSO2	before 1.3.0Unknown 1.3.0 to before 1.3.0.132Affected 1.4.0 to before 1.4.0.135Affected 1.5.0 to before 1.5.0.137Affected 2.0.0 to before 2.0.0.342Affected
WSO2 Carbon Synapse Artifact Uploader BEWSO2	4.4.10 to before 4.4.10.3Affected 4.6.1 to before 4.6.1.4Affected 4.6.6 to before 4.6.6.9Affected 4.6.10 to before 4.6.10.4Affected 4.6.16 to before 4.6.16.2Affected 4.6.19 to before 4.6.19.10Affected 4.6.64 to before 4.6.64.2Affected 4.6.67 to before 4.6.67.15Affected 4.6.89 to before 4.6.89.12Affected 4.6.105 to before 4.6.105.59Affected 4.6.150 to before 4.6.150.11Affected 4.7.20 to before 4.7.20.5Affected 4.7.30 to before 4.7.30.42Affected 4.7.35 to before 4.7.35.5Affected 4.7.61 to before 4.7.61.56Affected 4.7.99 to before 4.7.99.299Affected 4.7.131 to before 4.7.131.15Affected 4.7.175 to before 4.7.175.18Affected 4.7.188 to before 4.7.188.5Affected 4.7.204 to before 4.7.204.5Affected 4.7.216 and laterNot affected

References

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2024-3566/vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.