CVE-2024-7097: Incorrect Authorization in Multiple WSO2 Products via SOAP Admin Service Allowing Unauthorized User Signup
WSO2 · WSO2 Open Banking AM
Vendor fix available · Affected: WSO2 Open Banking AM · Exploitation: check available, not yet exploited
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
Higher than 52% of scored CVEs
DescriptionCVE.org
An incorrect authorization vulnerability exists in multiple WSO2 products due to a flaw in the SOAP admin service, which allows user account creation regardless of the self-registration configuration settings. This vulnerability enables malicious actors to create new user accounts without proper authorization. Exploitation of this flaw could allow an attacker to create multiple low-privileged user accounts, gaining unauthorized access to the system. Additionally, continuous exploitation could lead to system resource exhaustion through mass user creation.
Affected products7
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- WSO2 · WSO2 Open Banking AMfrom 1.3.0 before 1.3.0.131; from 1.4.0 before 1.4.0.134; from 1.5.0 before 1.5.0.136; from 2.0.0 before 2.0.0.343
- WSO2 · WSO2 Open Banking KMfrom 1.3.0 before 1.3.0.114; from 1.4.0 before 1.4.0.130; from 1.5.0 before 1.5.0.120
- WSO2 · WSO2 Identity Server as Key Managerfrom 5.3.0 before 5.3.0.38; from 5.5.0 before 5.5.0.51; from 5.6.0 before 5.6.0.72; from 5.7.0 before 5.7.0.122; from 5.9.0 before 5.9.0.165; from 5.10.0 before 5.10.0.312
- WSO2 · WSO2 API Managerfrom 2.0.0 before 2.0.0.29; from 2.1.0 before 2.1.0.39; from 2.2.0 before 2.2.0.56; from 2.5.0 before 2.5.0.83; from 2.6.0 before 2.6.0.142; from 3.0.0 before 3.0.0.162 and 7 more
- WSO2 · WSO2 Identity Serverfrom 5.2.0 before 5.2.0.32; from 5.3.0 before 5.3.0.33; from 5.4.0 before 5.4.0.32; from 5.4.1 before 5.4.1.36; from 5.5.0 before 5.5.0.50; from 5.6.0 before 5.6.0.58 and 8 more
- WSO2 · WSO2 Open Banking IAMfrom 2.0.0 before 2.0.0.364
- WSO2 · WSO2 Enterprise Mobility Managerfrom 2.2.0 before 2.2.0.26
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Check available, not yet exploited. A public nuclei template can confirm it on a system you are authorised to test.
- CISA KEV
- Not listed
- Public check
- WSO2 User Registration - Arbitrary Account Creation · nuclei template in projectdiscovery/nuclei-templates
- Vendor
- WSO2
- Published
- May 2025
CoverageNo articles yet
No CyberSIXT article names CVE-2024-7097 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.