Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.wso2.is:identity-server-parent

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 4.2MavenPublished

    WSO2 products vulnerable to privilege escalation due to business logic flaw in SOAP admin services

    CVE-2024-7096 · GHSA-j63j-7r7r-5v4j

    Affected
    • Maven org.wso2.is:identity-server-parent >= 5.2.0, <= 7.0.0
    Fixed in
    7.1.0· Vendor fix available
    Issue
    A privilege escalation vulnerability exists in multiple WSO2 products due to a business logic flaw in SOAP admin services. A malicious actor can create a new user with elevated permissions only when all of the following conditions are met: SOAP admin services are accessible to the attacker. The deployment includes an internally used attribute that is not part of the default WSO2 product configuration. At least one custom role exists with non-default permissions. The attacker has knowledge of the custom role and the internal attribute used in the deployment. Exploiting this vulnerability allows malicious actors to assign higher privileges to self-registered users, bypassing intended access control mechanisms.

    Recommended action: Upgrade to 7.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →