VULNERABILITY INTELLIGENCE

CVE-2024-7097

CVSS score4.3 MEDIUM
EPSS probability0.66%
CISA KEVNot currently listed
Published2025-05-30
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Description

An incorrect authorization vulnerability exists in multiple WSO2 products due to a flaw in the SOAP admin service, which allows user account creation regardless of the self-registration configuration settings. This vulnerability enables malicious actors to create new user accounts without proper authorization. Exploitation of this flaw could allow an attacker to create multiple low-privileged user accounts, gaining unauthorized access to the system. Additionally, continuous exploitation could lead to system resource exhaustion through mass user creation.

Weakness classification

  • 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-863

Primary references