{"id":"CVE-2024-7074","aliases":["EUVD-2024-54628","GHSA-7f34-p2r4-j656"],"status":"published","title":"Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Service Leading to Remote Code Execution","description":"An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user input in SOAP admin services. A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location on the server.\n\nBy leveraging this vulnerability, an attacker could upload a specially crafted payload, potentially achieving remote code execution (RCE) on the server. Exploitation requires valid admin credentials, limiting its impact to authorized but potentially malicious users.","severity":{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.17707,"percentile":0.97182,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-434"],"published":"2025-06-02T16:42:19Z","modified":"2026-06-17T08:19:18Z","products":[{"vendor":"wso2","product":"wso2 api manager"},{"vendor":"wso2","product":"wso2 carbon synapse artifact uploader be"},{"vendor":"wso2","product":"wso2 enterprise integrator"},{"vendor":"wso2","product":"wso2 enterprise mobility manager"},{"vendor":"wso2","product":"wso2 enterprise service bus"},{"vendor":"wso2","product":"wso2 micro integrator"},{"vendor":"wso2","product":"wso2 open banking am"}],"references":[{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2024-3566/","tags":["vendor-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-7074"},{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2024-3566"},{"url":"https://github.com/advisories/GHSA-7f34-p2r4-j656"}],"sources":{"cve":[{"id":"CVE-2024-7074","title":"Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Service Leading to Remote Code Execution","description":"An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user input in SOAP admin services. A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location on the server.\n\nBy leveraging this vulnerability, an attacker could upload a specially crafted payload, potentially achieving remote code execution (RCE) on the server. Exploitation requires valid admin credentials, limiting its impact to authorized but potentially malicious users.","status":"published","published":"2025-06-02T16:42:19.264Z","modified":"2025-06-02T17:05:49.92Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:34:21.025267Z"}],"euvd":[{"id":"EUVD-2024-54628","description":"An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user input in SOAP admin services. A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location on the server.\n\nBy leveraging this vulnerability, an attacker could upload a specially crafted payload, potentially achieving remote code execution (RCE) on the server. Exploitation requires valid admin credentials, limiting its impact to authorized but potentially malicious users.","status":"published","published":"2025-06-02T16:42:19Z","modified":"2025-06-02T17:05:49Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T20:32:32.485503Z"}],"ghsa":[{"id":"GHSA-7f34-p2r4-j656","title":"An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper...","description":"An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user input in SOAP admin services. A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location on the server.\n\nBy leveraging this vulnerability, an attacker could upload a specially crafted payload, potentially achieving remote code execution (RCE) on the server. Exploitation requires valid admin credentials, limiting its impact to authorized but potentially malicious users.","status":"published","published":"2025-06-02T18:30:52Z","modified":"2025-06-02T18:31:00Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T15:02:32.017383Z"}],"nvd":[{"id":"CVE-2024-7074","description":"An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user input in SOAP admin services. A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location on the server.\n\nBy leveraging this vulnerability, an attacker could upload a specially crafted payload, potentially achieving remote code execution (RCE) on the server. Exploitation requires valid admin credentials, limiting its impact to authorized but potentially malicious users.","status":"published","published":"2025-06-02T17:15:36.25Z","modified":"2026-06-17T08:19:18.81Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:10:47.073504Z"}]}}