CVE-2024-7097: wso2 api_manager Incorrect Authorization

Vulnerability summary

CVE-2024-7097 is a medium (CVSS 4.3) Incorrect Authorization vulnerability in wso2 api_manager. EPSS estimates a 0.66% chance of exploitation in the next 30 days, higher than 50.9% of scored vulnerabilities.

Timeline

1. 30-05-2025
   PublishedVulnerability first disclosed.
2. 30-05-2025
   Last modifiedVulnerability information updated.

Description

An incorrect authorization vulnerability exists in multiple WSO2 products due to a flaw in the SOAP admin service, which allows user account creation regardless of the self-registration configuration settings. This vulnerability enables malicious actors to create new user accounts without proper authorization. Exploitation of this flaw could allow an attacker to create multiple low-privileged user accounts, gaining unauthorized access to the system. Additionally, continuous exploitation could lead to system resource exhaustion through mass user creation.

• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.