Every CVE Search/ Get API key

CVE-2022-29464

Certain WSO2 products allow unrestricted file upload with resultant remote code execution. This...

9.8 CriticalIn KEVPublic exploit

Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps directory. This affects WSO2 API Manager 2.2.0 up to 4.0.0, WSO2 Identity Server 5.2.0 up to 5.11.0, WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0 and 5.6.0, WSO2 Identity Server as Key Manager 5.3.0 up to 5.11.0, WSO2 Enterprise Integrator 6.2.0 up to 6.6.0, WSO2 Open Banking AM 1.4.0 up to 2.0.0 and WSO2 Open Banking KM 1.4.0, up to 2.0.0.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

100.0%Up 97.3 points since Apr 19, 2022
90%50%10%1%

What each source reports

CVE List Score used 9.8

Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps directory. This affects WSO2 API Manager 2.2.0 up to 4.0.0, WSO2 Identity Server 5.2.0 up to 5.11.0, WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0 and 5.6.0, WSO2 Identity Server as Key Manager 5.3.0 up to 5.11.0, WSO2 Enterprise Integrator 6.2.0 up to 6.6.0, WSO2 Open Banking AM 1.4.0 up to 2.0.0 and WSO2 Open Banking KM 1.4.0, up to 2.0.0.

Record
CVE-2022-29464
CVSS 3.1
9.8 CriticalCVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N
Weakness
CWE-22
Updated
2026-11-02
EUVDEUVD-2022-33802 9.8

Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps directory. This affects WSO2 API Manager 2.2.0 up to 4.0.0, WSO2 Identity Server 5.2.0 up to 5.11.0, WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0 and 5.6.0, WSO2 Identity Server as Key Manager 5.3.0 up to 5.11.0, WSO2 Enterprise Integrator 6.2.0 up to 6.6.0, WSO2 Open Banking AM 1.4.0 up to 2.0.0 and WSO2 Open Banking KM 1.4.0, up to 2.0.0.

Record
EUVD-2022-33802
CVSS 3.1
9.8 CriticalCVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-mfgw-52pj-hrhg 9.8

Certain WSO2 products allow unrestricted file upload with resultant remote code execution. This...

Certain WSO2 products allow unrestricted file upload with resultant remote code execution. This affects WSO2 API Manager 2.2.0 and above through 4.0.0; WSO2 Identity Server 5.2.0 and above through 5.11.0; WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0, and 5.6.0; WSO2 Identity Server as Key Manager 5.3.0 and above through 5.10.0; and WSO2 Enterprise Integrator 6.2.0 and above through 6.6.0.

Record
GHSA-mfgw-52pj-hrhg
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-22, CWE-434
Updated
2026-11-02
CISA KEV No score

WSO2 Multiple Products Unrestrictive Upload of File Vulnerability

Multiple WSO2 products allow for unrestricted file upload, resulting in remote code execution.

Record
CVE-2022-29464
Weakness
CWE-22
Updated
2026-11-02
NVD 9.8

Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps directory. This affects WSO2 API Manager 2.2.0 up to 4.0.0, WSO2 Identity Server 5.2.0 up to 5.11.0, WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0 and 5.6.0, WSO2 Identity Server as Key Manager 5.3.0 up to 5.11.0, WSO2 Enterprise Integrator 6.2.0 up to 6.6.0, WSO2 Open Banking AM 1.4.0 up to 2.0.0 and WSO2 Open Banking KM 1.4.0, up to 2.0.0.

Record
CVE-2022-29464
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Weakness
CWE-22
Updated
2026-11-02
OSV 9.8

Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps directory. This affects WSO2 API Manager 2.2.0 up to 4.0.0, WSO2 Identity Server 5.2.0 up to 5.11.0, WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0 and 5.6.0, WSO2 Identity Server as Key Manager 5.3.0 up to 5.11.0, WSO2 Enterprise Integrator 6.2.0 up to 6.6.0, WSO2 Open Banking AM 1.4.0 up to 2.0.0 and WSO2 Open Banking KM 1.4.0, up to 2.0.0.

Record
CVE-2022-29464
CVSS 3.1
9.8 CriticalCVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N
Updated
2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
MetasploitWSO2 Arbitrary File Upload to RCE2022-04-01
PoC in GitHubhakivvi/CVE-2022-294642022-04-20
PoC in GitHubmr-r3bot/WSO2-CVE-2022-294642022-04-21
PoC in GitHubtufanturhan/wso2-rce-cve-2022-294642022-04-21
PoC in GitHub0xAgun/CVE-2022-294642022-04-22
PoC in GitHubLidong-io/cve-2022-294642022-04-22
PoC in GitHubgpiechnik2/nmap-CVE-2022-294642022-04-22
PoC in GitHubhev0x/CVE-2022-294642022-04-22
PoC in GitHubdsssssssm/WSOB2022-04-24
PoC in GitHubh3x0v3rl0rd/CVE-2022-294642022-04-24
Show 17 moreShow less
Public exploits
SourceLinkDate
PoC in GitHublowkey0808/cve-2022-294642022-04-26
PoC in GitHubsuperzerosec/CVE-2022-294642022-04-29
PoC in GitHubaxin2019/CVE-2022-294642022-05-05
PoC in GitHubLinJacck/CVE-2022-294642022-05-07
PoC in GitHubsh4den/CVE-2022-294642022-05-15
PoC in GitHubChocapikk/CVE-2022-294642022-05-26
PoC in GitHubjimidk/Better-CVE-2022-294642022-06-04
PoC in GitHubhxlxmj/Mass-exploit-CVE-2022-294642022-06-28
PoC in GitHubPasch0/WSO2RCE2022-07-05
PoC in GitHubr4x0r1337/-CVE-2022-294642022-08-01
PoC in GitHubamit-pathak009/CVE-2022-294642022-08-13
PoC in GitHubamit-pathak009/CVE-2022-29464-mass2022-08-13
PoC in GitHubhupe1980/CVE-2022-294642022-09-22
PoC in GitHubgbrsh/CVE-2022-294642022-11-14
PoC in GitHubdevengpk/CVE-2022-294642022-12-18
PoC in GitHubAp0dexMe0/CVE-2022-294642023-04-25
NucleiWSO2 Management - Arbitrary File Upload & Remote Code Execution

Plus 4 more. The full list has every link.

History

History
RecordedChangedSources
exploitation
exploits, exploits_more
exploits
first indexedCVE List, EUVD, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-29464 is a critical vulnerability (CVSS 9.8) in Wso2 Api Manager, published April 18, 2022. CISA lists it as known to be exploited, since April 25, 2022. EUVD reports exploitation since April 25, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 100.0%, the 99th percentile. No source names a fixed version.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open