CVE-2024-4457
published 2026-10-18CVE-2024-4457: The Management Console fails to properly validate input related to the configuration of JDBC user stores. This weakness allows an attacker to supply specially…
PriorityP260critical9.1CVSS 3.1
AVNACLPRNUINSUCHIHAN
EPSS
0.39%
31.5th percentile
The Management Console fails to properly validate input related to the configuration of JDBC user stores. This weakness allows an attacker to supply specially crafted input that can lead to the execution of arbitrary code on the affected server.
Successful exploitation of this vulnerability enables an attacker to execute arbitrary code on the server with the privileges of the WSO2 product. This could lead to a full compromise of the system.
Affected
28 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| wso2 | wso2_api_manager | >= 3.1.0 < 3.1.0.275 | 3.1.0.275 |
| wso2 | wso2_api_manager | >= 3.2.0 < 3.2.0.365 | 3.2.0.365 |
| wso2 | wso2_api_manager | >= 3.2.1 < 3.2.1.19 | 3.2.1.19 |
| wso2 | wso2_api_manager | >= 4.0.0 < 4.0.0.308 | 4.0.0.308 |
| wso2 | wso2_api_manager | >= 4.1.0 < 4.1.0.170 | 4.1.0.170 |
| wso2 | wso2_api_manager | >= 4.2.0 < 4.2.0.107 | 4.2.0.107 |
| wso2 | wso2_api_manager | >= 4.3.0 < 4.3.0.21 | 4.3.0.21 |
| wso2 | wso2_carbon_user_manager_kernel | >= 4.10.9 < 4.10.9.10 | 4.10.9.10 |
| wso2 | wso2_carbon_user_manager_kernel | >= 4.5.0 < 4.5.0.4 | 4.5.0.4 |
| wso2 | wso2_carbon_user_manager_kernel | >= 4.5.3 < 4.5.3.34 | 4.5.3.34 |
| wso2 | wso2_carbon_user_manager_kernel | >= 4.6.0 < 4.6.0.141 | 4.6.0.141 |
| wso2 | wso2_carbon_user_manager_kernel | >= 4.6.1 < 4.6.1.108 | 4.6.1.108 |
| wso2 | wso2_carbon_user_manager_kernel | >= 4.6.2 < 4.6.2.610 | 4.6.2.610 |
| wso2 | wso2_carbon_user_manager_kernel | >= 4.6.3 < 4.6.3.23 | 4.6.3.23 |
| wso2 | wso2_carbon_user_manager_kernel | >= 4.6.4 < 4.6.4.5 | 4.6.4.5 |
| wso2 | wso2_carbon_user_manager_kernel | >= 4.7.1 < 4.7.1.51 | 4.7.1.51 |
| wso2 | wso2_carbon_user_manager_kernel | >= 4.8.1 < 4.8.1.23 | 4.8.1.23 |
| wso2 | wso2_carbon_user_manager_kernel | >= 4.9.0 < 4.9.0.54 | 4.9.0.54 |
| wso2 | wso2_carbon_user_manager_kernel | >= 4.9.26 < 4.9.26.13 | 4.9.26.13 |
| wso2 | wso2_enterprise_integrator | >= 6.6.0 < 6.6.0.204 | 6.6.0.204 |
| wso2 | wso2_identity_server | >= 5.10.0 < 5.10.0.296 | 5.10.0.296 |
| wso2 | wso2_identity_server | >= 5.11.0 < 5.11.0.336 | 5.11.0.336 |
| wso2 | wso2_identity_server | >= 6.0.0 < 6.0.0.188 | 6.0.0.188 |
| wso2 | wso2_identity_server | >= 6.1.0 < 6.1.0.148 | 6.1.0.148 |
| wso2 | wso2_identity_server | >= 7.0.0 < 7.0.0.15 | 7.0.0.15 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
WSO2 API Manager Management Console input validation
vuldb·2026-10-18
CVE-2024-4457 WSO2 API Manager Management Console input validation
A vulnerability marked as very critical has been reported in WSO2 API Manager, Carbon User Manager Kernel, Enterprise Integrator, Identity Server, Identity Server as Key Manager, Open Banking AM and Open Banking IAM. The impacted element is an unknown function of the component Management Console. This manipulation causes improper input validation.
The identification of this vulnerability is CVE-2024-4457. It is possible to initiate the attack remotely. There is no exploit available.
GHSA
The Management Console fails to properly validate input related to the configuration of JDBC user stores.
ghsa_unreviewed·2026-10-18
CVE-2024-4457 CWE-78 The Management Console fails to properly validate input related to the configuration of JDBC user stores.
The Management Console fails to properly validate input related to the configuration of JDBC user stores. This weakness allows an attacker to supply specially crafted input that can lead to the execution of arbitrary code on the affected server.
Successful exploitation of this vulnerability enables an attacker to execute arbitrary code on the server with the privileges of the WSO2 product. This could lead to a full compromise of the system.
No detection rules found.
No public exploits indexed.
2026-10-18
Published