{"schemaVersion":3,"id":"CVE-2022-29464","aliases":[],"status":"published","duplicateOf":null,"title":"WSO2 Multiple Products Unrestrictive Upload of File Vulnerability","description":"Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps directory. This affects WSO2 API Manager 2.2.0 up to 4.0.0, WSO2 Identity Server 5.2.0 up to 5.11.0, WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0 and 5.6.0, WSO2 Identity Server as Key Manager 5.3.0 up to 5.11.0, WSO2 Enterprise Integrator 6.2.0 up to 6.6.0, WSO2 Open Banking AM 1.4.0 up to 2.0.0 and WSO2 Open Banking KM 1.4.0, up to 2.0.0.","dates":{"published":"2022-04-18T00:00:00.000Z","modified":"2025-10-21T23:15:41.688Z","reserved":null,"kevAdded":["2022-04-25T00:00:00.000Z"],"kevDue":["2022-05-16T00:00:00.000Z"]},"cvss":{"headline":{"score":10,"severity":"high","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":9.8,"severity":"critical","vector":"CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":10,"severity":"high","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.99999,"percentile":0.99993,"severity":"critical","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.99999},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.99999,"percentile":0.99993}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.99999,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.99999,"percentile":0.99993}]},"kev":{"state":"listed","entries":[{"source":"cisa","sourceLabel":"CISA","dateAdded":"2022-04-25T00:00:00.000Z","dueDate":"2022-05-16T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"WSO2 Multiple Products Unrestrictive Upload of File Vulnerability","description":"Multiple WSO2 products allow for unrestricted file upload, resulting in remote code execution.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2022-29464","label":"nvd.nist.gov/vuln/detail/CVE-2022-29464"}],"vendor":"WSO2","product":"Multiple Products","ransomware":true,"ransomwareUse":"Known","exploitationType":null}],"listedCount":1,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":true,"entry":{"source":"cisa","sourceLabel":"CISA","dateAdded":"2022-04-25T00:00:00.000Z","dueDate":"2022-05-16T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"WSO2 Multiple Products Unrestrictive Upload of File Vulnerability","description":"Multiple WSO2 products allow for unrestricted file upload, resulting in remote code execution.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2022-29464","label":"nvd.nist.gov/vuln/detail/CVE-2022-29464"}],"vendor":"WSO2","product":"Multiple Products","ransomware":true,"ransomwareUse":"Known","exploitationType":null}},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"known","sources":["cisa"]},"exploits":[{"id":"GITHUB_HAKIVVI_CVE-2022-29464","name":"Cve 2022 29464","source":"github","url":"https://github.com/hakivvi/CVE-2022-29464","maturity":"poc","reliabilityScore":0.3,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"REF_D2CE9AA5B3948EF7","name":"Exploit Reference (packetstormsecurity.com)","source":"reference","url":"http://packetstormsecurity.com/files/166921/WSO-Arbitrary-File-Upload-Remote-Code-Execution.html","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"MSF_EXPLOIT_MULTI_HTTP_WSO2_FILE_UPLOAD_RCE","name":"WSO2 Arbitrary File Upload to RCE","source":"metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploit/multi/http/wso2_file_upload_rce.rb","maturity":"weaponized","reliabilityScore":1,"verified":true,"type":"remote","platforms":[],"requiresAuth":false,"exploitdb":null,"metasploit":{"fullname":"exploit/multi/http/wso2_file_upload_rce","rank":"600","rankName":"excellent","postAuth":false,"check":true,"stability":["crash-safe"],"sideEffects":["ioc-in-logs","artifacts-on-disk"],"reliability":["repeatable-session"]}}],"exploitCount":3,"weaknesses":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","description":"The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/22.html"}],"affected":[{"vendor":"wso2","product":"api_manager","name":"api manager","label":"api_manager","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 2.2.0, ≤ 4.0.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 2.2.0, ≤ 4.0.0","eol":null,"hubHref":"/vendor/wso2/api_manager"},{"vendor":"wso2","product":"enterprise_integrator","name":"enterprise integrator","label":"enterprise_integrator","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 6.2.0, ≤ 6.6.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 6.2.0, ≤ 6.6.0","eol":null,"hubHref":"/vendor/wso2/enterprise_integrator"},{"vendor":"wso2","product":"identity_server","name":"identity server","label":"identity_server","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 5.2.0, ≤ 5.11.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 5.2.0, ≤ 5.11.0","eol":null,"hubHref":"/vendor/wso2/identity_server"},{"vendor":"wso2","product":"identity_server_analytics","name":"identity server analytics","label":"identity_server_analytics","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"5.4.0","noFixRecorded":false,"fixedIn":null},{"text":"5.4.1","noFixRecorded":false,"fixedIn":null},{"text":"5.5.0","noFixRecorded":false,"fixedIn":null},{"text":"5.6.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"5.4.0 | 5.4.1 | 5.5.0 | 5.6.0","eol":null,"hubHref":"/vendor/wso2/identity_server_analytics"},{"vendor":"wso2","product":"identity_server_as_key_manager","name":"identity server as key manager","label":"identity_server_as_key_manager","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 5.3.0, ≤ 5.10.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 5.3.0, ≤ 5.10.0","eol":null,"hubHref":"/vendor/wso2/identity_server_as_key_manager"},{"vendor":"wso2","product":"open_banking_am","name":"open banking am","label":"open_banking_am","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 1.3.0, ≤ 2.0.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 1.3.0, ≤ 2.0.0","eol":null,"hubHref":"/vendor/wso2/open_banking_am"},{"vendor":"wso2","product":"open_banking_iam","name":"open banking iam","label":"open_banking_iam","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"2.0.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"2.0.0","eol":null,"hubHref":"/vendor/wso2/open_banking_iam"},{"vendor":"wso2","product":"open_banking_km","name":"open banking km","label":"open_banking_km","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 1.3.0, ≤ 1.5.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 1.3.0, ≤ 1.5.0","eol":null,"hubHref":"/vendor/wso2/open_banking_km"}],"affectedCount":8,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://www.openwall.com/lists/oss-security/2022/04/22/7","label":"www.openwall.com/lists/oss-security/2022/04/22/7","hostname":"www.openwall.com","tags":["Mailing List","Third Party Advisory"]},{"url":"https://github.com/hakivvi/CVE-2022-29464","label":"github.com/hakivvi/CVE-2022-29464","hostname":"github.com","tags":["Exploit","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/166921/WSO-Arbitrary-File-Upload-Remote-Code-Execution.html","label":"packetstormsecurity.com/files/166921/WSO-Arbitrary-File-Upload-Remote-Code-Execution.html","hostname":"packetstormsecurity.com","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2022/WSO2-2021-1738/","label":"security.docs.wso2.com/en/latest/security-announcements/security-advisories/2022/WSO2-2021-1738/","hostname":"security.docs.wso2.com","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-29464","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-29464","hostname":"www.cisa.gov","tags":["Government Resource","US Government Resource"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2022-04-18T00:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"kev-added","date":"2022-04-25T00:00:00.000Z","label":"Added to CISA KEV","detail":"WSO2 Multiple Products Unrestrictive Upload of File Vulnerability","source":"cisa"},{"kind":"kev-due","date":"2022-05-16T00:00:00.000Z","label":"CISA remediation due","detail":"Apply updates per vendor instructions.","source":"cisa"},{"kind":"modified","date":"2025-10-21T23:15:41.688Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":100,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T19:08:14.644Z","stale":false,"partial":false}}