CVE-2024-4457: Remote Code Execution via JDBC User Store Configuration in Multiple WSO2 Products Allows Arbitrary Code Execution
The Management Console fails to properly validate input related to the configuration of JDBC user stores. This weakness allows an attacker to supply specially crafted input that can lead to the execution of arbitrary code on the affected server.
Successful exploitation of this vulnerability enables an attacker to execute arbitrary code on the server with the privileges of the WSO2 product. This could lead to a full compromise of the system.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The provided information does not specify the authentication or authorization level required to configure JDBC user stores. Exploitation requires supplying specially crafted input through JDBC user store configuration in the Management Console.
What privileges would successful code execution have?
Arbitrary code executes with the privileges of the affected WSO2 product. This could enable full compromise of the system.
Which WSO2 versions or products are affected?
The provided data identifies the WSO2 Management Console but does not list affected versions or a complete product/version matrix.