Remote Code Execution via JDBC User Store Configuration in Multiple WSO2 Products Allows Arbitrary Code Execution
Summary
| CVE | CVE-2024-4457 |
|---|---|
| State | PUBLISHED |
| Assigner | WSO2 |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-18 18:16:28 UTC |
| Updated | 2026-10-19 21:06:28 UTC |
| Description | The Management Console fails to properly validate input related to the configuration of JDBC user stores. This weakness allows an attacker to supply specially crafted input that can lead to the execution of arbitrary code on the affected server. Successful exploitation of this vulnerability enables an attacker to execute arbitrary code on the server with the privileges of the WSO2 product. This could lead to a full compromise of the system. |
Risk And Classification
Problem Types: CWE-78 | CWE-78 CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | WSO2 | WSO2 Enterprise Integrator | unknown 6.6.0 custom | Not specified |
| CNA | WSO2 | WSO2 Enterprise Integrator | affected 6.6.0 6.6.0.204 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | unknown 3.1.0 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 3.1.0 3.1.0.275 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 3.2.0 3.2.0.365 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 3.2.1 3.2.1.19 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 4.0.0 4.0.0.308 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 4.1.0 4.1.0.170 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 4.2.0 4.2.0.107 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 4.3.0 4.3.0.21 custom | Not specified |
| CNA | WSO2 | WSO2 Open Banking AM | unknown 2.0.0 custom | Not specified |
| CNA | WSO2 | WSO2 Open Banking AM | affected 2.0.0 2.0.0.325 custom | Not specified |
| CNA | WSO2 | WSO2 Open Banking IAM | unknown 2.0.0 custom | Not specified |
| CNA | WSO2 | WSO2 Open Banking IAM | affected 2.0.0 2.0.0.345 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server As Key Manager | unknown 5.10.0 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server As Key Manager | affected 5.10.0 5.10.0.292 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server | unknown 5.10.0 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server | affected 5.10.0 5.10.0.296 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server | affected 5.11.0 5.11.0.336 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server | affected 6.0.0 6.0.0.188 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server | affected 6.1.0 6.1.0.148 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server | affected 7.0.0 7.0.0.15 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon User Manager Kernel | affected 4.5.0 4.5.0.4 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon User Manager Kernel | affected 4.5.3 4.5.3.34 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon User Manager Kernel | affected 4.6.0 4.6.0.141 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon User Manager Kernel | affected 4.6.1 4.6.1.108 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon User Manager Kernel | affected 4.6.2 4.6.2.610 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon User Manager Kernel | affected 4.6.3 4.6.3.23 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon User Manager Kernel | affected 4.6.4 4.6.4.5 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon User Manager Kernel | affected 4.7.1 4.7.1.51 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon User Manager Kernel | affected 4.8.1 4.8.1.23 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon User Manager Kernel | affected 4.9.0 4.9.0.54 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon User Manager Kernel | affected 4.9.26 4.9.26.13 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon User Manager Kernel | affected 4.10.9 4.10.9.10 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon User Manager Kernel | unaffected 4.9.27 * custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO... | ed10eef1-636d-4fbe-9993-6890dfa878f8 | security.docs.wso2.com | |
| github.com/wso2/carbon-kernel/pull/4067 | ed10eef1-636d-4fbe-9993-6890dfa878f8 | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Additional Advisory Data
Solutions
CNA: Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2023-3084/#solution
There are currently no legacy QID mappings associated with this CVE.