{"schema":"threatline.record/2","record":{"id":"CVE-2024-4457","aliases":[],"summary":"Remote Code Execution via JDBC User Store Configuration in Multiple WSO2 Products Allows Arbitrary Code Execution","details":"The Management Console fails to properly validate input related to the configuration of JDBC user stores. This weakness allows an attacker to supply specially crafted input that can lead to the execution of arbitrary code on the affected server.\n\nSuccessful exploitation of this vulnerability enables an attacker to execute arbitrary code on the server with the privileges of the WSO2 product. This could lead to a full compromise of the system.","categories":["Unclassified"],"product":"WSO2 Enterprise Integrator","vendor":"WSO2","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4457","source_modified_at":"2026-10-20T18:41:54.437Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"WSO2 Enterprise Integrator","vendor":"WSO2","versions":[{"status":"unknown","version":"0","lessThan":"6.6.0","versionType":"custom"},{"status":"affected","version":"6.6.0","lessThan":"6.6.0.204","versionType":"custom"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4457","source_modified_at":"2026-10-20T18:41:54.437Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"WSO2 API Manager","vendor":"WSO2","versions":[{"status":"unknown","version":"0","lessThan":"3.1.0","versionType":"custom"},{"status":"affected","version":"3.1.0","lessThan":"3.1.0.275","versionType":"custom"},{"status":"affected","version":"3.2.0","lessThan":"3.2.0.365","versionType":"custom"},{"status":"affected","version":"3.2.1","lessThan":"3.2.1.19","versionType":"custom"},{"status":"affected","version":"4.0.0","lessThan":"4.0.0.308","versionType":"custom"},{"status":"affected","version":"4.1.0","lessThan":"4.1.0.170","versionType":"custom"},{"status":"affected","version":"4.2.0","lessThan":"4.2.0.107","versionType":"custom"},{"status":"affected","version":"4.3.0","lessThan":"4.3.0.21","versionType":"custom"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4457","source_modified_at":"2026-10-20T18:41:54.437Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"WSO2 Open Banking AM","vendor":"WSO2","versions":[{"status":"unknown","version":"0","lessThan":"2.0.0","versionType":"custom"},{"status":"affected","version":"2.0.0","lessThan":"2.0.0.325","versionType":"custom"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4457","source_modified_at":"2026-10-20T18:41:54.437Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"WSO2 Open Banking IAM","vendor":"WSO2","versions":[{"status":"unknown","version":"0","lessThan":"2.0.0","versionType":"custom"},{"status":"affected","version":"2.0.0","lessThan":"2.0.0.345","versionType":"custom"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4457","source_modified_at":"2026-10-20T18:41:54.437Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"WSO2 Identity Server as Key Manager","vendor":"WSO2","versions":[{"status":"unknown","version":"0","lessThan":"5.10.0","versionType":"custom"},{"status":"affected","version":"5.10.0","lessThan":"5.10.0.292","versionType":"custom"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4457","source_modified_at":"2026-10-20T18:41:54.437Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"WSO2 Identity Server","vendor":"WSO2","versions":[{"status":"unknown","version":"0","lessThan":"5.10.0","versionType":"custom"},{"status":"affected","version":"5.10.0","lessThan":"5.10.0.296","versionType":"custom"},{"status":"affected","version":"5.11.0","lessThan":"5.11.0.336","versionType":"custom"},{"status":"affected","version":"6.0.0","lessThan":"6.0.0.188","versionType":"custom"},{"status":"affected","version":"6.1.0","lessThan":"6.1.0.148","versionType":"custom"},{"status":"affected","version":"7.0.0","lessThan":"7.0.0.15","versionType":"custom"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4457","source_modified_at":"2026-10-20T18:41:54.437Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"WSO2 Carbon User Manager Kernel","vendor":"WSO2","versions":[{"status":"affected","version":"4.5.0","lessThan":"4.5.0.4","versionType":"custom"},{"status":"affected","version":"4.5.3","lessThan":"4.5.3.34","versionType":"custom"},{"status":"affected","version":"4.6.0","lessThan":"4.6.0.141","versionType":"custom"},{"status":"affected","version":"4.6.1","lessThan":"4.6.1.108","versionType":"custom"},{"status":"affected","version":"4.6.2","lessThan":"4.6.2.610","versionType":"custom"},{"status":"affected","version":"4.6.3","lessThan":"4.6.3.23","versionType":"custom"},{"status":"affected","version":"4.6.4","lessThan":"4.6.4.5","versionType":"custom"},{"status":"affected","version":"4.7.1","lessThan":"4.7.1.51","versionType":"custom"},{"status":"affected","version":"4.8.1","lessThan":"4.8.1.23","versionType":"custom"},{"status":"affected","version":"4.9.0","lessThan":"4.9.0.54","versionType":"custom"},{"status":"affected","version":"4.9.26","lessThan":"4.9.26.13","versionType":"custom"},{"status":"affected","version":"4.10.9","lessThan":"4.10.9.10","versionType":"custom"},{"status":"unaffected","version":"4.9.27","lessThanOrEqual":"*","versionType":"custom"}],"defaultStatus":"unknown"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4457","source_modified_at":"2026-10-20T18:41:54.437Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Enterprise Integrator","ecosystem":null},"version":"6.6.0.204","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4457","source_modified_at":"2026-10-20T18:41:54.437Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 API Manager","ecosystem":null},"version":"3.1.0.275","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4457","source_modified_at":"2026-10-20T18:41:54.437Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 API Manager","ecosystem":null},"version":"3.2.0.365","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4457","source_modified_at":"2026-10-20T18:41:54.437Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 API Manager","ecosystem":null},"version":"3.2.1.19","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4457","source_modified_at":"2026-10-20T18:41:54.437Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 API Manager","ecosystem":null},"version":"4.0.0.308","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4457","source_modified_at":"2026-10-20T18:41:54.437Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 API Manager","ecosystem":null},"version":"4.1.0.170","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4457","source_modified_at":"2026-10-20T18:41:54.437Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 API Manager","ecosystem":null},"version":"4.2.0.107","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4457","source_modified_at":"2026-10-20T18:41:54.437Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 API Manager","ecosystem":null},"version":"4.3.0.21","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4457","source_modified_at":"2026-10-20T18:41:54.437Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Open Banking AM","ecosystem":null},"version":"2.0.0.325","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4457","source_modified_at":"2026-10-20T18:41:54.437Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Open Banking IAM","ecosystem":null},"version":"2.0.0.345","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4457","source_modified_at":"2026-10-20T18:41:54.437Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Identity Server as Key Manager","ecosystem":null},"version":"5.10.0.292","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4457","source_modified_at":"2026-10-20T18:41:54.437Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Identity Server","ecosystem":null},"version":"5.10.0.296","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4457","source_modified_at":"2026-10-20T18:41:54.437Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Identity Server","ecosystem":null},"version":"5.11.0.336","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4457","source_modified_at":"2026-10-20T18:41:54.437Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Identity Server","ecosystem":null},"version":"6.0.0.188","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4457","source_modified_at":"2026-10-20T18:41:54.437Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Identity Server","ecosystem":null},"version":"6.1.0.148","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4457","source_modified_at":"2026-10-20T18:41:54.437Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Identity Server","ecosystem":null},"version":"7.0.0.15","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4457","source_modified_at":"2026-10-20T18:41:54.437Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon User Manager Kernel","ecosystem":null},"version":"4.5.0.4","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4457","source_modified_at":"2026-10-20T18:41:54.437Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon User Manager Kernel","ecosystem":null},"version":"4.5.3.34","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4457","source_modified_at":"2026-10-20T18:41:54.437Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon User Manager Kernel","ecosystem":null},"version":"4.6.0.141","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4457","source_modified_at":"2026-10-20T18:41:54.437Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon User Manager Kernel","ecosystem":null},"version":"4.6.1.108","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4457","source_modified_at":"2026-10-20T18:41:54.437Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon User Manager Kernel","ecosystem":null},"version":"4.6.2.610","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4457","source_modified_at":"2026-10-20T18:41:54.437Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon User Manager Kernel","ecosystem":null},"version":"4.6.3.23","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4457","source_modified_at":"2026-10-20T18:41:54.437Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon User Manager Kernel","ecosystem":null},"version":"4.6.4.5","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4457","source_modified_at":"2026-10-20T18:41:54.437Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon User Manager Kernel","ecosystem":null},"version":"4.7.1.51","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4457","source_modified_at":"2026-10-20T18:41:54.437Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon User Manager Kernel","ecosystem":null},"version":"4.8.1.23","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4457","source_modified_at":"2026-10-20T18:41:54.437Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon User Manager Kernel","ecosystem":null},"version":"4.9.0.54","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4457","source_modified_at":"2026-10-20T18:41:54.437Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon User Manager Kernel","ecosystem":null},"version":"4.9.26.13","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4457","source_modified_at":"2026-10-20T18:41:54.437Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon User Manager Kernel","ecosystem":null},"version":"4.10.9.10","basis":"first unaffected version stated in the CVE record"}],"cvss":9.1,"severity":"Critical","kev":{"listed":false},"epss":{"probability":0.00387,"percentile":0.31577,"score_date":"2026-10-23"},"published_at":"2026-10-18T18:05:34.050Z","modified_at":"2026-10-20T18:41:54.437Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2024-4457","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-20T18:41:54.437Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-4457","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2023-3084/","tags":["vendor-advisory"]},{"source":"CVE List","url":"https://github.com/wso2/carbon-kernel/pull/4067","tags":["patch"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CISA ADP","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"total","assessed_at":"2026-10-20T18:41:46.314171Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-20T18:41:54.437Z","content_hash":"4f897643e258fe4370f33457fd58c37ac3a98e983b231952ef0f921da3e84ece"}}