cveboard RSS feed

CVE-2024-6914

CVE.org · Published

Historical CVEsJSONAI instructions

Record status
Published
Identifier year (not publication year)
2024
Source publication
Source updated
Imported by cveboard
Source snapshot
cve_2026-10-24_midnight_baseline ·

Plain text

CNA source text (English)

Incorrect Authorization in Multiple WSO2 Products via Account Recovery SOAP Admin Service Leading to Account Takeover

An incorrect authorization vulnerability exists in multiple WSO2 products due to a business logic flaw in the account recovery-related SOAP admin service. A malicious actor can exploit this vulnerability to reset the password of any user account, leading to a complete account takeover, including accounts with elevated privileges. This vulnerability is exploitable only through the account recovery SOAP admin services exposed via the "/services" context path in affected products. The impact may be reduced if access to these endpoints has been restricted based on the "Security Guidelines for Production Deployment" by disabling exposure to untrusted networks.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

WSO2 API Manager

Vendor
WSO2
Product
WSO2 API Manager
Platforms
Unknown
Default status
unaffected
WSO2 API Manager · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0unknowncustom2.2.0UnavailableNone listed
2.2.0affectedcustom2.2.0.55UnavailableNone listed
2.5.0affectedcustom2.5.0.82UnavailableNone listed
2.6.0affectedcustom2.6.0.141UnavailableNone listed
3.0.0affectedcustom3.0.0.161UnavailableNone listed
3.1.0affectedcustom3.1.0.292UnavailableNone listed
3.2.0affectedcustom3.2.0.382UnavailableNone listed
3.2.1affectedcustom3.2.1.14UnavailableNone listed
4.0.0affectedcustom4.0.0.304UnavailableNone listed
4.1.0affectedcustom4.1.0.164UnavailableNone listed
4.2.0affectedcustom4.2.0.99UnavailableNone listed
4.3.0affectedcustom4.3.0.15UnavailableNone listed

WSO2 Governance Registry

Vendor
WSO2
Product
WSO2 Governance Registry
Platforms
Unknown
Default status
unknown
WSO2 Governance Registry · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
5.4.0affectedcustom5.4.0.14UnavailableNone listed

WSO2 Identity Server

Vendor
WSO2
Product
WSO2 Identity Server
Platforms
Unknown
Default status
unaffected
WSO2 Identity Server · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0unknowncustom5.3.0UnavailableNone listed
5.3.0affectedcustom5.3.0.31UnavailableNone listed
5.4.0affectedcustom5.4.0.30UnavailableNone listed
5.4.1affectedcustom5.4.1.35UnavailableNone listed
5.5.0affectedcustom5.5.0.48UnavailableNone listed
5.6.0affectedcustom5.6.0.56UnavailableNone listed
5.7.0affectedcustom5.7.0.122UnavailableNone listed
5.8.0affectedcustom5.8.0.104UnavailableNone listed
5.9.0affectedcustom5.9.0.155UnavailableNone listed
5.10.0affectedcustom5.10.0.317UnavailableNone listed
5.11.0affectedcustom5.11.0.363UnavailableNone listed
6.0.0affectedcustom6.0.0.207UnavailableNone listed
6.1.0affectedcustom6.1.0.184UnavailableNone listed
7.0.0affectedcustom7.0.0.56UnavailableNone listed

WSO2 Identity Server as Key Manager

Vendor
WSO2
Product
WSO2 Identity Server as Key Manager
Platforms
Unknown
Default status
unaffected
WSO2 Identity Server as Key Manager · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0unknowncustom5.3.0UnavailableNone listed
5.3.0affectedcustom5.3.0.36UnavailableNone listed
5.5.0affectedcustom5.5.0.49UnavailableNone listed
5.6.0affectedcustom5.6.0.70UnavailableNone listed
5.7.0affectedcustom5.7.0.121UnavailableNone listed
5.9.0affectedcustom5.9.0.162UnavailableNone listed
5.10.0affectedcustom5.10.0.311UnavailableNone listed

WSO2 IoT

Vendor
WSO2
Product
WSO2 IoT
Platforms
Unknown
Default status
unknown
WSO2 IoT · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
3.3.0affectedcustom3.3.0.59UnavailableNone listed
3.3.1affectedcustom3.3.1.61UnavailableNone listed

WSO2 Open Banking AM

Vendor
WSO2
Product
WSO2 Open Banking AM
Platforms
Unknown
Default status
unaffected
WSO2 Open Banking AM · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0unknowncustom1.3.0UnavailableNone listed
1.3.0affectedcustom1.3.0.130UnavailableNone listed
1.4.0affectedcustom1.4.0.133UnavailableNone listed
1.5.0affectedcustom1.5.0.135UnavailableNone listed
2.0.0affectedcustom2.0.0.341UnavailableNone listed

WSO2 Open banking KM

Vendor
WSO2
Product
WSO2 Open banking KM
Platforms
Unknown
Default status
unaffected
WSO2 Open banking KM · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0unknowncustom1.3.0UnavailableNone listed
1.3.0affectedcustom1.3.0.113UnavailableNone listed
1.4.0affectedcustom1.4.0.129UnavailableNone listed
1.5.0affectedcustom1.5.0.119UnavailableNone listed

WSO2 Open Banking IAM

Vendor
WSO2
Product
WSO2 Open Banking IAM
Platforms
Unknown
Default status
unaffected
WSO2 Open Banking IAM · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
2.0.0affectedcustom2.0.0.362UnavailableNone listed

WSO2 Carbon Identity Management

Vendor
WSO2
Product
WSO2 Carbon Identity Management
Platforms
Unknown
Default status
unknown
Package
org.wso2.carbon.identity.framework:org.wso2.carbon.identity.mgt
WSO2 Carbon Identity Management · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
5.7.5affectedcustom5.7.5.9UnavailableNone listed
5.10.86affectedcustom5.10.86.4UnavailableNone listed
5.10.112affectedcustom5.10.112.14UnavailableNone listed
5.11.148affectedcustom5.11.148.13UnavailableNone listed
5.11.256affectedcustom5.11.256.15UnavailableNone listed
5.12.153affectedcustom5.12.153.58UnavailableNone listed
5.12.387affectedcustom5.12.387.41UnavailableNone listed
5.14.97affectedcustom5.14.97.75UnavailableNone listed
5.17.5affectedcustom5.17.5.282UnavailableNone listed
5.17.118affectedcustom5.17.118.4UnavailableNone listed
5.18.187affectedcustom5.18.187.265UnavailableNone listed
5.18.248affectedcustom5.18.248.14UnavailableNone listed
5.23.8affectedcustom5.23.8.184UnavailableNone listed
5.24.8affectedcustom5.24.8.6UnavailableNone listed
5.25.92affectedcustom5.25.92.92UnavailableNone listed
5.25.705affectedcustom5.25.705.6UnavailableNone listed
7.0.78affectedcustom7.0.78.32UnavailableNone listed
7.3.44unaffectedcustomUnavailable*None listed