CVE-2024-7074

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user input in SOAP admin services. A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location on the server.

By leveraging this vulnerability, an attacker could upload a specially crafted payload, potentially achieving remote code execution (RCE) on the server. Exploitation requires valid admin credentials, limiting its impact to authorized but potentially malicious users.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

VendorProductVersions
WSO2WSO2 Enterprise Integrator>= 6.0.0, < 6.0.0.21; >= 6.1.0, < 6.1.0.38; >= 6.1.1, < 6.1.1.42; >= 6.2.0, < 6.2.0.61; >= 6.3.0, < 6.3.0.69; >= 6.4.0, < 6.4.0.96; >= 6.5.0, < 6.5.0.102; >= 6.6.0, < 6.6.0.198
WSO2WSO2 API Manager>= 2.0.0, < 2.0.0.28; >= 2.1.0, < 2.1.0.38; >= 2.2.0, < 2.2.0.57; >= 2.5.0, < 2.5.0.83; >= 2.6.0, < 2.6.0.143; >= 3.0.0, < 3.0.0.162; >= 3.1.0, < 3.1.0.293; >= 3.2.0, < 3.2.0.384; >= 3.2.1, < 3.2.1.16; >= 4.0.0, < 4.0.0.305; >= 4.1.0, < 4.1.0.166; >= 4.2.0, < 4.2.0.100; >= 4.3.0, < 4.3.0.16
WSO2WSO2 Enterprise Service Bus>= 4.9.0, < 4.9.0.10; >= 5.0.0, < 5.0.0.28
WSO2WSO2 Enterprise Mobility Manager>= 2.2.0, < 2.2.0.27
WSO2WSO2 Micro Integrator>= 1.0.0, < 1.0.0.49
WSO2WSO2 Open Banking AM>= 1.3.0, < 1.3.0.132; >= 1.4.0, < 1.4.0.135; >= 1.5.0, < 1.5.0.137; >= 2.0.0, < 2.0.0.342
WSO2WSO2 Carbon Synapse Artifact Uploader BE>= 4.4.10, < 4.4.10.3; >= 4.6.1, < 4.6.1.4; >= 4.6.6, < 4.6.6.9; >= 4.6.10, < 4.6.10.4; >= 4.6.16, < 4.6.16.2; >= 4.6.19, < 4.6.19.10; >= 4.6.64, < 4.6.64.2; >= 4.6.67, < 4.6.67.15; >= 4.6.89, < 4.6.89.12; >= 4.6.105, < 4.6.105.59; >= 4.6.150, < 4.6.150.11; >= 4.7.20, < 4.7.20.5; >= 4.7.30, < 4.7.30.42; >= 4.7.35, < 4.7.35.5; >= 4.7.61, < 4.7.61.56; >= 4.7.99, < 4.7.99.299; >= 4.7.131, < 4.7.131.15; >= 4.7.175, < 4.7.175.18; >= 4.7.188, < 4.7.188.5; >= 4.7.204, < 4.7.204.5

References

Timeline

Published
Jun 2, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-70754.6The user search function within the management console fails to properly encode user-supplied input before rendering it in the browser. ThisCVE-2024-70769.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Semtek Informatics Software ConsultingCVE-2024-70776.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Semtek Informatics Software ConsultingCVE-2024-70789.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Semtek Informatics Software ConsultingCVE-2024-70796.5A flaw was found in the Openshift console. The /API/helm/verify endpoint is tasked to fetch and verify the installation of a Helm chart fromCVE-2024-70807.5A vulnerability was found in SourceCodester Insurance Management System 1.0. It has been declared as problematic. Affected by this vulnerabiCVE-2024-70819.8A vulnerability was found in itsourcecode Tailoring Management System 1.0. It has been rated as critical. Affected by this issue is some unkCVE-2024-70826.1The Easy Table of Contents WordPress plugin before 2.0.68 does not sanitise and escape some parameters, which could allow users with a role CVE-2024-70833.5The Email Encoder WordPress plugin before 2.3.4 does not sanitise and escape some of its settings, which could allow high privilege users sCVE-2024-70844.8The Ajax Search Lite WordPress plugin before 4.12.1 does not sanitise and escape some parameters, which could allow users with a role as lowCVE-2024-70858.2Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in OpenText™ Solutions Business MaCVE-2024-70906.1The LH Add Media From Url plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘lh_add_media_from_url-file_url’ para