CVE-2024-4457: Remote Code Execution via JDBC User Store Configuration in Multiple WSO2 Products Allows Arbitrary Code Execution

Versions reported by the vendor

Affected version ranges reported by the assigning authority (WSO2). Independent of NVD's CPE analysis and usually ahead of it.

• WSO2 WSO2 API Manager

  • before 3.1.0unknown
  • 3.1.0 and later · before 3.1.0.275affected
  • 3.2.0 and later · before 3.2.0.365affected
  • 3.2.1 and later · before 3.2.1.19affected
  • 4.0.0 and later · before 4.0.0.308affected
  • 4.1.0 and later · before 4.1.0.170affected
  • 4.2.0 and later · before 4.2.0.107affected
  • 4.3.0 and later · before 4.3.0.21affected

• WSO2 WSO2 Carbon User Manager Kernel

  • 4.5.0 and later · before 4.5.0.4affected
  • 4.5.3 and later · before 4.5.3.34affected
  • 4.6.0 and later · before 4.6.0.141affected
  • 4.6.1 and later · before 4.6.1.108affected
  • 4.6.2 and later · before 4.6.2.610affected
  • 4.6.3 and later · before 4.6.3.23affected
  • 4.6.4 and later · before 4.6.4.5affected
  • 4.7.1 and later · before 4.7.1.51affected
  • 4.8.1 and later · before 4.8.1.23affected
  • 4.9.0 and later · before 4.9.0.54affected

• WSO2 WSO2 Enterprise Integrator

  • before 6.6.0unknown
  • 6.6.0 and later · before 6.6.0.204affected

• WSO2 WSO2 Identity Server

  • before 5.10.0unknown
  • 5.10.0 and later · before 5.10.0.296affected
  • 5.11.0 and later · before 5.11.0.336affected
  • 6.0.0 and later · before 6.0.0.188affected
  • 6.1.0 and later · before 6.1.0.148affected
  • 7.0.0 and later · before 7.0.0.15affected

• WSO2 WSO2 Identity Server as Key Manager

  • before 5.10.0unknown
  • 5.10.0 and later · before 5.10.0.292affected

• WSO2 WSO2 Open Banking AM

  • before 2.0.0unknown
  • 2.0.0 and later · before 2.0.0.325affected

• WSO2 WSO2 Open Banking IAM

  • before 2.0.0unknown
  • 2.0.0 and later · before 2.0.0.345affected

Other highest-scoring records for the same primary product.

• CVE-2024-7074Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Service Leading to Remote Code Execution
  32Monitor
• CVE-2024-5139Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and Redirection
  24Monitor
• CVE-2025-12317Improper Token Revocation via SOAP Services in Multiple WSO2 Products Allows Retained Access Privileges
  20Monitor

Published before and after this one in the same product

• Later →CVE-2024-4412Oct 19, 2026 · Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations
  10Monitor
• Later →CVE-2024-2323Oct 20, 2026 · Password Brute Force via Password History Validation in Multiple WSO2 Products Allows User Account Discovery
  19Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

User input is inserted as text into a shell command. The shell may interpret special characters in the input as part of the command.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const host = req.body.host;2exec("ping -c 1 " + host, onResult);

1const host = req.body.host;2if (!/^[a-z0-9.-]{1,253}$/i.test(host)) return res.sendStatus(400);3execFile("ping", ["-c", "1", host], onResult);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.