CVE-2022-29464

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps directory. This affects WSO2 API Manager 2.2.0 up to 4.0.0, WSO2 Identity Server 5.2.0 up to 5.11.0, WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0 and 5.6.0, WSO2 Identity Server as Key Manager 5.3.0 up to 5.11.0, WSO2 Enterprise Integrator 6.2.0 up to 6.6.0, WSO2 Open Banking AM 1.4.0 up to 2.0.0 and WSO2 Open Banking KM 1.4.0, up to 2.0.0.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/166921/WSO-Arbitrary-File-Upload-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
http://www.openwall.com/lists/oss-security/2022/04/22/7Mailing List, Third Party Advisory
https://github.com/hakivvi/CVE-2022-29464Exploit, Third Party Advisory
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2022/WSO2-2021-1738/Vendor Advisory
http://packetstormsecurity.com/files/166921/WSO-Arbitrary-File-Upload-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
http://www.openwall.com/lists/oss-security/2022/04/22/7Mailing List, Third Party Advisory
https://github.com/hakivvi/CVE-2022-29464Exploit, Third Party Advisory
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2022/WSO2-2021-1738/Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-29464US Government Resource

Timeline

Published: Apr 18, 2022
Last modified: Jun 17, 2026
Added to CISA KEV: Apr 25, 2022
NVD status: Analyzed

Related CVEs from 2022

CVE-2022-294659.8An out-of-bounds write vulnerability exists in the PSD Header processing memory allocation functionality of Accusoft ImageGear 20.0. A speci CVE-2022-294665.5Improper input validation in firmware for Intel(R) SPS before version SPS_E3_04.01.04.700.0 may allow an authenticated user to potentially e CVE-2022-294674.3Address information disclosure vulnerability in Cybozu Garoon 4.2.0 to 5.5.1 allows a remote authenticated attacker to obtain some data of A CVE-2022-294688.8A cross-site request forgery (CSRF) vulnerability exists in WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP reques CVE-2022-29477.8Altair HyperView Player versions 2021.1.0.27 and prior perform operations on a memory buffer but can read from or write to a memory location CVE-2022-294707.8Improper access control in the Intel® DTT Software before version 8.7.10400.15482 may allow an authenticated user to potentially enable esca CVE-2022-294714.3Browse restriction bypass vulnerability in Bulletin of Cybozu Garoon allows a remote authenticated attacker to obtain the data of Bulletin.CVE-2022-294729.8An OS command injection vulnerability exists in the web interface util_set_serial_mac functionality of Abode Systems, Inc. iota All-In-One S CVE-2022-294737.5On F5 BIG-IP 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, when an IPSec ALG pr CVE-2022-294744.3On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior CVE-2022-294758.1An information disclosure vulnerability exists in the XFINDER functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9 CVE-2022-294766.1Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in 8 Degree Themes otification Bar for WordPress plugin <= 1.1.8 at WordPres