CVE-2022-29464

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-29464
Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps directory. This affects WSO2 API Manager 2.2.0 up to 4.0.0, WSO2 Identity Server 5.2.0 up to 5.11.0, WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0 and 5.6.0, WSO2 Identity Server as Key Manager 5.3.0 up to 5.11.0, WSO2 Enterprise Integrator 6.2.0 up to 6.6.0, WSO2 Open Banking AM 1.4.0 up to 2.0.0 and WSO2 Open Banking KM 1.4.0, up to 2.0.0.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

10.0 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References
Link Resource
http://packetstormsecurity.com/files/166921/WSO-Arbitrary-File-Upload-Remote-Code-Execution.html Exploit Third Party Advisory VDB Entry
http://www.openwall.com/lists/oss-security/2022/04/22/7 Mailing List Third Party Advisory
https://github.com/hakivvi/CVE-2022-29464 Exploit Third Party Advisory
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2022/WSO2-2021-1738/
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:wso2:enterprise_integrator:*:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server_analytics:5.4.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server_analytics:5.4.1:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server_analytics:5.5.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server_analytics:5.6.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server_as_key_manager:*:*:*:*:*:*:*:*
History

23 Oct 2023, 22:15

Type Values Removed Values Added
Summary Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps directory. This affects WSO2 API Manager 2.2.0 and above through 4.0.0; WSO2 Identity Server 5.2.0 and above through 5.11.0; WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0, and 5.6.0; WSO2 Identity Server as Key Manager 5.3.0 and above through 5.10.0; and WSO2 Enterprise Integrator 6.2.0 and above through 6.6.0. Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps directory. This affects WSO2 API Manager 2.2.0 up to 4.0.0, WSO2 Identity Server 5.2.0 up to 5.11.0, WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0 and 5.6.0, WSO2 Identity Server as Key Manager 5.3.0 up to 5.11.0, WSO2 Enterprise Integrator 6.2.0 up to 6.6.0, WSO2 Open Banking AM 1.4.0 up to 2.0.0 and WSO2 Open Banking KM 1.4.0, up to 2.0.0.

18 Oct 2023, 22:15

Type Values Removed Values Added
References
  • {'url': 'https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2021-1738', 'name': 'https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2021-1738', 'tags': ['Mitigation', 'Vendor Advisory'], 'refsource': 'MISC'}
  • (MISC) https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2022/WSO2-2021-1738/ -

08 Aug 2023, 14:22

Type Values Removed Values Added
CWE CWE-434 CWE-22

09 Sep 2022, 16:54

Type Values Removed Values Added
References (MISC) http://packetstormsecurity.com/files/166921/WSO-Arbitrary-File-Upload-Remote-Code-Execution.html - (MISC) http://packetstormsecurity.com/files/166921/WSO-Arbitrary-File-Upload-Remote-Code-Execution.html - Exploit, Third Party Advisory, VDB Entry

02 May 2022, 18:15

Type Values Removed Values Added
References
  • (MISC) http://packetstormsecurity.com/files/166921/WSO-Arbitrary-File-Upload-Remote-Code-Execution.html -

25 Apr 2022, 18:47

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : 10.0
v3 : 9.8
CWE CWE-434
CPE cpe:2.3:a:wso2:identity_server_as_key_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:wso2:enterprise_integrator:*:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server_analytics:5.4.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server_analytics:5.6.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server_analytics:5.4.1:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server_analytics:5.5.0:*:*:*:*:*:*:*
References (MLIST) http://www.openwall.com/lists/oss-security/2022/04/22/7 - (MLIST) http://www.openwall.com/lists/oss-security/2022/04/22/7 - Mailing List, Third Party Advisory
References (MISC) https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2021-1738 - (MISC) https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2021-1738 - Mitigation, Vendor Advisory
References (MISC) https://github.com/hakivvi/CVE-2022-29464 - (MISC) https://github.com/hakivvi/CVE-2022-29464 - Exploit, Third Party Advisory
First Time Wso2 identity Server
Wso2 api Manager
Wso2
Wso2 identity Server As Key Manager
Wso2 enterprise Integrator
Wso2 identity Server Analytics

23 Apr 2022, 04:15

Type Values Removed Values Added
Summary Certain WSO2 products allow unrestricted file upload with resultant remote code execution. This affects WSO2 API Manager 2.2.0 and above through 4.0.0; WSO2 Identity Server 5.2.0 and above through 5.11.0; WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0, and 5.6.0; WSO2 Identity Server as Key Manager 5.3.0 and above through 5.10.0; and WSO2 Enterprise Integrator 6.2.0 and above through 6.6.0. Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps directory. This affects WSO2 API Manager 2.2.0 and above through 4.0.0; WSO2 Identity Server 5.2.0 and above through 5.11.0; WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0, and 5.6.0; WSO2 Identity Server as Key Manager 5.3.0 and above through 5.10.0; and WSO2 Enterprise Integrator 6.2.0 and above through 6.6.0.
References
  • (MISC) https://github.com/hakivvi/CVE-2022-29464 -

22 Apr 2022, 21:15

Type Values Removed Values Added
References
  • (MLIST) http://www.openwall.com/lists/oss-security/2022/04/22/7 -

18 Apr 2022, 22:15

Type Values Removed Values Added
New CVE
Information

Published : 2022-04-18 22:15

Updated : 2023-12-10 14:22

NVD link : CVE-2022-29464

Mitre link : CVE-2022-29464

CVE.ORG link : CVE-2022-29464

JSON object : View

Products Affected

wso2

  • identity_server_as_key_manager
  • api_manager
  • enterprise_integrator
  • identity_server_analytics
  • identity_server
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')