CVE-2024-4457
WSO2 WSO2 Enterprise Integrator
- WSO2 WSO2 Enterprise Integrator
- Critical
- CVSS 9.1
- EPSS 0.39%
- Fixed version listed
What to do
Fixed version listed
Affected products
| Product | Affected | Fixed in |
|---|---|---|
| WSO2 WSO2 Enterprise Integrator | from 6.6.0, before 6.6.0.204 | 6.6.0.204 |
| WSO2 WSO2 API Manager | from 3.1.0, before 3.1.0.275; from 3.2.0, before 3.2.0.365; from 3.2.1, before 3.2.1.19; from 4.0.0, before 4.0.0.308; from 4.1.0, before 4.1.0.170; from 4.2.0, before 4.2.0.107; from 4.3.0, before 4.3.0.21 | 3.1.0.275, 3.2.0.365, 3.2.1.19, 4.0.0.308, 4.1.0.170, 4.2.0.107, 4.3.0.21 |
| WSO2 WSO2 Open Banking AM | from 2.0.0, before 2.0.0.325 | 2.0.0.325 |
| WSO2 WSO2 Open Banking IAM | from 2.0.0, before 2.0.0.345 | 2.0.0.345 |
| WSO2 WSO2 Identity Server as Key Manager | from 5.10.0, before 5.10.0.292 | 5.10.0.292 |
| WSO2 WSO2 Identity Server | from 5.10.0, before 5.10.0.296; from 5.11.0, before 5.11.0.336; from 6.0.0, before 6.0.0.188; from 6.1.0, before 6.1.0.148; from 7.0.0, before 7.0.0.15 | 5.10.0.296, 5.11.0.336, 6.0.0.188, 6.1.0.148, 7.0.0.15 |
| WSO2 WSO2 Carbon User Manager Kernel | from 4.5.0, before 4.5.0.4; from 4.5.3, before 4.5.3.34; from 4.6.0, before 4.6.0.141; from 4.6.1, before 4.6.1.108; from 4.6.2, before 4.6.2.610; from 4.6.3, before 4.6.3.23; from 4.6.4, before 4.6.4.5; from 4.7.1, before 4.7.1.51; from 4.8.1, before 4.8.1.23; from 4.9.0, before 4.9.0.54; from 4.9.26, before 4.9.26.13; from 4.10.9, before 4.10.9.10 | 4.5.0.4, 4.5.3.34, 4.6.0.141, 4.6.1.108, 4.6.2.610, 4.6.3.23, 4.6.4.5, 4.7.1.51, 4.8.1.23, 4.9.0.54, 4.9.26.13, 4.10.9.10, 4.9.27 |
Advisories and fixes
- Vendor advisory security.docs.wso2.com
- Patch github.com
Scores and signals
- Exploitation
- No known exploitation
- Severity
- Critical, CVSS 9.1 (v3.1, scored by CISA-ADP)
- EPSS
- 0.39% chance of exploitation in the next 30 days (EPSS from FIRST, as of Oct 23, 2026)
- CISA's SSVC decision points
- Exploitation: none. Automatable: yes. Technical impact: total. As of Oct 20, 2026.
- Weakness
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
- Vendor
- WSO2, WSO2 Enterprise Integrator
Timeline
- First listed as critical by cve.now. Affected and fixed versions come from the CVE record, once one is published.