github - ghsa-77h2-x83m-w6w9

GHSA-77H2-X83M-W6W9

Vulnerability from github – Published: 2025-06-02 18:30 – Updated: 2025-06-02 18:30

Details

Exploitation of this vulnerability could lead to unauthorized access to sensitive data and systems, including resources within private networks, as long as they are reachable by the affected product.

Severity ?

6.5 (Medium)


                  
                    CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-7073"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-06-02T17:15:36Z",
    "severity": "MODERATE"
  },
  "details": "A server-side request forgery (SSRF) vulnerability exists in multiple WSO2 products due to improper input validation in SOAP admin services. This flaw allows unauthenticated attackers to manipulate server-side requests, enabling access to internal and external resources available through the network or filesystem.\n\nExploitation of this vulnerability could lead to unauthorized access to sensitive data and systems, including resources within private networks, as long as they are reachable by the affected product.",
  "id": "GHSA-77h2-x83m-w6w9",
  "modified": "2025-06-02T18:30:52Z",
  "published": "2025-06-02T18:30:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7073"
    },
    {
      "type": "WEB",
      "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3562"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2024-7073 (GCVE-0-2024-7073)

Vulnerability from cvelistv5 – Published: 2025-06-02 16:38 – Updated: 2025-06-02 17:06

Summary

A server-side request forgery (SSRF) vulnerability exists in multiple WSO2 products due to improper input validation in SOAP admin services. This flaw allows unauthenticated attackers to manipulate server-side requests, enabling access to internal and external resources available through the network or filesystem. Exploitation of this vulnerability could lead to unauthorized access to sensitive data and systems, including resources within private networks, as long as they are reachable by the affected product.

Severity ?

6.5 (Medium)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

WSO2

References

URL

Tags

https://security.docs.wso2.com/en/latest/security…

vendor-advisory

Impacted products

Vendor

Product

Version

WSO2

WSO2 Identity Server as Key Manager

Unknown: 0 , < 5.3.0 (custom)
Affected: 5.3.0 , < 5.3.0.37 (custom)
Affected: 5.5.0 , < 5.5.0.50 (custom)
Affected: 5.6.0 , < 5.6.0.71 (custom)
Affected: 5.7.0 , < 5.7.0.122 (custom)
Affected: 5.9.0 , < 5.9.0.165 (custom)
Affected: 5.10.0 , < 5.10.0.312 (custom)

WSO2	WSO2 Identity Server	Unknown: 0 , < 5.2.0 (custom) Affected: 5.2.0 , < 5.2.0.32 (custom) Affected: 5.3.0 , < 5.3.0.32 (custom) Affected: 5.4.0 , < 5.4.0.31 (custom) Affected: 5.4.1 , < 5.4.1.36 (custom) Affected: 5.5.0 , < 5.5.0.49 (custom) Affected: 5.6.0 , < 5.6.0.57 (custom) Affected: 5.7.0 , < 5.7.0.123 (custom) Affected: 5.8.0 , < 5.8.0.105 (custom) Affected: 5.9.0 , < 5.9.0.156 (custom) Affected: 5.10.0 , < 5.10.0.318 (custom) Affected: 5.11.0 , < 5.11.0.364 (custom) Affected: 6.0.0 , < 6.0.0.208 (custom) Affected: 6.1.0 , < 6.1.0.187 (custom) Affected: 7.0.0 , < 7.0.0.59 (custom)
WSO2	WSO2 Open Banking KM	Unknown: 0 , < 1.3.0 (custom) Affected: 1.3.0 , < 1.3.0.114 (custom) Affected: 1.4.0 , < 1.4.0.130 (custom) Affected: 1.5.0 , < 1.5.0.120 (custom)
WSO2	WSO2 Open Banking IAM	Unknown: 0 , < 2.0.0 (custom) Affected: 2.0.0 , < 2.0.0.363 (custom)
WSO2	WSO2 Carbon Policy Editor BE	Affected: 5.2.2 , < 5.2.2.14 (custom) Affected: 5.7.5 , < 5.7.5.15 (custom) Affected: 5.10.86 , < 5.10.86.5 (custom) Affected: 5.10.112 , < 5.10.112.16 (custom) Affected: 5.11.148 , < 5.11.148.15 (custom) Affected: 5.11.256 , < 5.11.256.17 (custom) Affected: 5.12.153 , < 5.12.153.59 (custom) Affected: 5.12.387 , < 5.12.387.42 (custom) Affected: 5.14.97 , < 5.14.97.76 (custom) Affected: 5.17.5 , < 5.17.5.284 (custom) Affected: 5.18.187 , < 5.18.187.268 (custom) Affected: 5.23.8 , < 5.23.8.186 (custom) Affected: 5.25.92 , < 5.25.92.95 (custom) Affected: 7.0.78 , < 7.0.78.35 (custom) Unaffected: 7.4.3 , ≤ * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-7073",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-02T17:04:26.386536Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-02T17:06:05.767Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Identity Server as Key Manager",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.3.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.3.0.37",
              "status": "affected",
              "version": "5.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.5.0.50",
              "status": "affected",
              "version": "5.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.6.0.71",
              "status": "affected",
              "version": "5.6.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.7.0.122",
              "status": "affected",
              "version": "5.7.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.9.0.165",
              "status": "affected",
              "version": "5.9.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.10.0.312",
              "status": "affected",
              "version": "5.10.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Identity Server",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.2.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.2.0.32",
              "status": "affected",
              "version": "5.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.3.0.32",
              "status": "affected",
              "version": "5.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.4.0.31",
              "status": "affected",
              "version": "5.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.4.1.36",
              "status": "affected",
              "version": "5.4.1",
              "versionType": "custom"
            },
            {
              "lessThan": "5.5.0.49",
              "status": "affected",
              "version": "5.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.6.0.57",
              "status": "affected",
              "version": "5.6.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.7.0.123",
              "status": "affected",
              "version": "5.7.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.8.0.105",
              "status": "affected",
              "version": "5.8.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.9.0.156",
              "status": "affected",
              "version": "5.9.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.10.0.318",
              "status": "affected",
              "version": "5.10.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.11.0.364",
              "status": "affected",
              "version": "5.11.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.0.0.208",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.1.0.187",
              "status": "affected",
              "version": "6.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.0.0.59",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Open Banking KM",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "1.3.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.3.0.114",
              "status": "affected",
              "version": "1.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.4.0.130",
              "status": "affected",
              "version": "1.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.5.0.120",
              "status": "affected",
              "version": "1.5.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Open Banking IAM",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "2.0.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.0.0.363",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.identity.framework:org.wso2.carbon.policyeditor",
          "product": "WSO2 Carbon Policy Editor BE",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.2.2.14",
              "status": "affected",
              "version": "5.2.2",
              "versionType": "custom"
            },
            {
              "lessThan": "5.7.5.15",
              "status": "affected",
              "version": "5.7.5",
              "versionType": "custom"
            },
            {
              "lessThan": "5.10.86.5",
              "status": "affected",
              "version": "5.10.86",
              "versionType": "custom"
            },
            {
              "lessThan": "5.10.112.16",
              "status": "affected",
              "version": "5.10.112",
              "versionType": "custom"
            },
            {
              "lessThan": "5.11.148.15",
              "status": "affected",
              "version": "5.11.148",
              "versionType": "custom"
            },
            {
              "lessThan": "5.11.256.17",
              "status": "affected",
              "version": "5.11.256",
              "versionType": "custom"
            },
            {
              "lessThan": "5.12.153.59",
              "status": "affected",
              "version": "5.12.153",
              "versionType": "custom"
            },
            {
              "lessThan": "5.12.387.42",
              "status": "affected",
              "version": "5.12.387",
              "versionType": "custom"
            },
            {
              "lessThan": "5.14.97.76",
              "status": "affected",
              "version": "5.14.97",
              "versionType": "custom"
            },
            {
              "lessThan": "5.17.5.284",
              "status": "affected",
              "version": "5.17.5",
              "versionType": "custom"
            },
            {
              "lessThan": "5.18.187.268",
              "status": "affected",
              "version": "5.18.187",
              "versionType": "custom"
            },
            {
              "lessThan": "5.23.8.186",
              "status": "affected",
              "version": "5.23.8",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.92.95",
              "status": "affected",
              "version": "5.25.92",
              "versionType": "custom"
            },
            {
              "lessThan": "7.0.78.35",
              "status": "affected",
              "version": "7.0.78",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.4.3",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A server-side request forgery (SSRF) vulnerability exists in multiple WSO2 products due to improper input validation in SOAP admin services. This flaw allows unauthenticated attackers to manipulate server-side requests, enabling access to internal and external resources available through the network or filesystem.\u003cbr\u003e\u003cbr\u003eExploitation of this vulnerability could lead to unauthorized access to sensitive data and systems, including resources within private networks, as long as they are reachable by the affected product.\u003cbr\u003e"
            }
          ],
          "value": "A server-side request forgery (SSRF) vulnerability exists in multiple WSO2 products due to improper input validation in SOAP admin services. This flaw allows unauthenticated attackers to manipulate server-side requests, enabling access to internal and external resources available through the network or filesystem.\n\nExploitation of this vulnerability could lead to unauthorized access to sensitive data and systems, including resources within private networks, as long as they are reachable by the affected product."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-06-02T16:38:33.113Z",
        "orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
        "shortName": "WSO2"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3562"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Follow the instructions given on \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3562/#solution\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3...\u003c/a\u003e \u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "Follow the instructions given on  https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3... https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3562/#solution"
        }
      ],
      "source": {
        "advisory": "WSO2-2024-3562",
        "discovery": "INTERNAL"
      },
      "title": "Unauthenticated Server-Side Request Forgery (SSRF) in Multiple WSO2 Products via SOAP Admin Services",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
    "assignerShortName": "WSO2",
    "cveId": "CVE-2024-7073",
    "datePublished": "2025-06-02T16:38:33.113Z",
    "dateReserved": "2024-07-24T12:09:10.530Z",
    "dateUpdated": "2025-06-02T17:06:05.767Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-77H2-X83M-W6W9

CVE-2024-7073 (GCVE-0-2024-7073)

Tags

Sightings

Nomenclature