CVE-2024-4457
9.1CriticalPublished 18 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality, integrity
- Weakness
- CWE-78
Impact
Remote attackers can execute arbitrary code with WSO2 service privileges and compromise the server. They only need network access to reach the Management Console without needing prior authentication.
Root cause
The Management Console fails to sanitize user input when configuring JDBC user stores, leading to command injection.
Affected systems
WSO2 Carbon Kernel products; exact versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Fix & remediation
Apply the patch from Carbon Kernel pull request #4067 or update to the version specified in advisory WSO2-2023-3084. As an interim workaround, restrict network access to the Management Console interface using firewall rules or reverse proxy controls.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
The Management Console fails to properly validate input related to the configuration of JDBC user stores. This weakness allows an attacker to supply specially crafted input that can lead to the execution of arbitrary code on the affected server. Successful exploitation of this vulnerability enables an attacker to execute arbitrary code on the server with the privileges of the WSO2 product. This could lead to a full compromise of the system.