CVE-2022-29464

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-29464
Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps directory. This affects WSO2 API Manager 2.2.0 up to 4.0.0, WSO2 Identity Server 5.2.0 up to 5.11.0, WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0 and 5.6.0, WSO2 Identity Server as Key Manager 5.3.0 up to 5.11.0, WSO2 Enterprise Integrator 6.2.0 up to 6.6.0, WSO2 Open Banking AM 1.4.0 up to 2.0.0 and WSO2 Open Banking KM 1.4.0, up to 2.0.0.

9.8 /10

CVSS v3.0 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

10.0 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References
Link Resource
http://packetstormsecurity.com/files/166921/WSO-Arbitrary-File-Upload-Remote-Code-Execution.html Exploit Third Party Advisory VDB Entry
http://packetstormsecurity.com/files/166921/WSO-Arbitrary-File-Upload-Remote-Code-Execution.html Exploit Third Party Advisory VDB Entry
http://www.openwall.com/lists/oss-security/2022/04/22/7 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/04/22/7 Mailing List Third Party Advisory
https://github.com/hakivvi/CVE-2022-29464 Exploit Third Party Advisory
https://github.com/hakivvi/CVE-2022-29464 Exploit Third Party Advisory
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2022/WSO2-2021-1738/ Vendor Advisory
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2022/WSO2-2021-1738/ Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:wso2:identity_server_analytics:5.5.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server_analytics:5.4.1:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server_analytics:5.6.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server_analytics:5.4.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*
cpe:2.3:a:wso2:enterprise_integrator:*:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server_as_key_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:wso2:open_banking_iam:2.0.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:open_banking_km:*:*:*:*:*:*:*:*
cpe:2.3:a:wso2:open_banking_am:*:*:*:*:*:*:*:*
History

29 Jan 2025, 21:15

Type Values Removed Values Added
References (MISC) https://github.com/hakivvi/CVE-2022-29464 - Exploit, Third Party Advisory () https://github.com/hakivvi/CVE-2022-29464 - Exploit, Third Party Advisory
References (MISC) https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2022/WSO2-2021-1738/ - Vendor Advisory () https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2022/WSO2-2021-1738/ - Vendor Advisory
References (MLIST) http://www.openwall.com/lists/oss-security/2022/04/22/7 - Mailing List, Third Party Advisory () http://www.openwall.com/lists/oss-security/2022/04/22/7 - Mailing List, Third Party Advisory
References (MISC) http://packetstormsecurity.com/files/166921/WSO-Arbitrary-File-Upload-Remote-Code-Execution.html - Exploit, Third Party Advisory, VDB Entry () http://packetstormsecurity.com/files/166921/WSO-Arbitrary-File-Upload-Remote-Code-Execution.html - Exploit, Third Party Advisory, VDB Entry

02 Jul 2024, 17:05

Type Values Removed Values Added
CPE cpe:2.3:a:wso2:open_banking_km:*:*:*:*:*:*:*:*
cpe:2.3:a:wso2:open_banking_am:*:*:*:*:*:*:*:*
cpe:2.3:a:wso2:open_banking_iam:2.0.0:*:*:*:*:*:*:*
References (MISC) https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2022/WSO2-2021-1738/ - (MISC) https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2022/WSO2-2021-1738/ - Vendor Advisory
First Time Wso2 open Banking Km
Wso2 open Banking Iam
Wso2 open Banking Am

23 Oct 2023, 22:15

Type Values Removed Values Added
Summary Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps directory. This affects WSO2 API Manager 2.2.0 and above through 4.0.0; WSO2 Identity Server 5.2.0 and above through 5.11.0; WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0, and 5.6.0; WSO2 Identity Server as Key Manager 5.3.0 and above through 5.10.0; and WSO2 Enterprise Integrator 6.2.0 and above through 6.6.0. Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps directory. This affects WSO2 API Manager 2.2.0 up to 4.0.0, WSO2 Identity Server 5.2.0 up to 5.11.0, WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0 and 5.6.0, WSO2 Identity Server as Key Manager 5.3.0 up to 5.11.0, WSO2 Enterprise Integrator 6.2.0 up to 6.6.0, WSO2 Open Banking AM 1.4.0 up to 2.0.0 and WSO2 Open Banking KM 1.4.0, up to 2.0.0.

18 Oct 2023, 22:15

Type Values Removed Values Added
References
  • {'url': 'https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2021-1738', 'name': 'https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2021-1738', 'tags': ['Mitigation', 'Vendor Advisory'], 'refsource': 'MISC'}
  • (MISC) https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2022/WSO2-2021-1738/ -

08 Aug 2023, 14:22

Type Values Removed Values Added
CWE CWE-434 CWE-22
Information

Published : 2022-04-18 22:15

Updated : 2025-04-03 18:54

NVD link : CVE-2022-29464

Mitre link : CVE-2022-29464

JSON object : View

Products Affected

wso2

  • open_banking_km
  • identity_server_as_key_manager
  • enterprise_integrator
  • open_banking_am
  • open_banking_iam
  • identity_server_analytics
  • api_manager
  • identity_server
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')