cbcvebase.
CVE-2024-7073
published 2025-06-02

CVE-2024-7073: A server-side request forgery (SSRF) vulnerability exists in multiple WSO2 products due to improper input validation in SOAP admin services. This flaw allows…

PriorityP433medium6.5CVSS 3.1
AVAACLPRNUINSUCHINAN
EPSS
0.19%
8.5th percentile
A server-side request forgery (SSRF) vulnerability exists in multiple WSO2 products due to improper input validation in SOAP admin services. This flaw allows unauthenticated attackers to manipulate server-side requests, enabling access to internal and external resources available through the network or filesystem. Exploitation of this vulnerability could lead to unauthorized access to sensitive data and systems, including resources within private networks, as long as they are reachable by the affected product.

Affected

62 ranges· showing 25
VendorProductVersion rangeFixed in
wso2identity_server——
wso2identity_server——
wso2identity_server——
wso2identity_server——
wso2identity_server——
wso2identity_server——
wso2identity_server——
wso2identity_server——
wso2identity_server——
wso2identity_server——
wso2identity_server——
wso2identity_server——
wso2identity_server——
wso2identity_server——
wso2identity_server_as_key_manager——
wso2identity_server_as_key_manager——
wso2identity_server_as_key_manager——
wso2identity_server_as_key_manager——
wso2identity_server_as_key_manager——
wso2identity_server_as_key_manager——
wso2open_banking_iam——
wso2open_banking_km——
wso2open_banking_km——
wso2open_banking_km——
wso2wso2_carbon_policy_editor_be>= 5.10.112 < 5.10.112.165.10.112.16
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.