CVE-2024-6914

Katalog CVE

CVSS 9.8 · Critical EPSS 0,72%

Kerentanan Incorrect Authorization pada wso2 api manager, wso2 identity server +4 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut CNA.

Deskripsi (NVD)

An incorrect authorization vulnerability exists in multiple WSO2 products due to a business logic flaw in the account recovery-related SOAP admin service. A malicious actor can exploit this vulnerability to reset the password of any user account, leading to a complete account takeover, including accounts with elevated privileges. This vulnerability is exploitable only through the account recovery SOAP admin services exposed via the "/services" context path in affected products. The impact may be reduced if access to these endpoints has been restricted based on the "Security Guidelines for Production Deployment" by disabling exposure to untrusted networks.

Rincian

Terbit di NVD

22 Mei 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,72% peluang dieksploitasi; lebih tinggi dari 52,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3561/ advisory vendor
• https://security.docs.wso2.com/en/latest/security-guidelines/security-guidelines-for-production-deployment/ advisory vendor