CVE-2024-6914

{"id": "CVE-2024-6914", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2025-05-22T19:15:42.853", "references": [{"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3561/", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}, {"url": "https://security.docs.wso2.com/en/latest/security-guidelines/security-guidelines-for-production-deployment/", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "An incorrect authorization vulnerability exists in multiple WSO2 products due to a business logic flaw in the account recovery-related SOAP admin service. A malicious actor can exploit this vulnerability to reset the password of any user account, leading to a complete account takeover, including accounts with elevated privileges.\n\nThis vulnerability is exploitable only through the account recovery SOAP admin services exposed via the \"/services\" context path in affected products. The impact may be reduced if access to these endpoints has been restricted based on the \"Security Guidelines for Production Deployment\" by disabling exposure to untrusted networks."}, {"lang": "es", "value": "Existe una vulnerabilidad de autorizaci\u00f3n incorrecta en varios productos WSO2 debido a una falla en la l\u00f3gica de negocio del servicio de administraci\u00f3n SOAP relacionado con la recuperaci\u00f3n de cuentas. Un atacante puede explotar esta vulnerabilidad para restablecer la contrase\u00f1a de cualquier cuenta de usuario, lo que conlleva el robo total de la cuenta, incluso de cuentas con privilegios elevados. Esta vulnerabilidad solo se puede explotar a trav\u00e9s de los servicios de administraci\u00f3n SOAP de recuperaci\u00f3n de cuentas expuestos mediante la ruta de contexto \"/services\" en los productos afectados. El impacto puede reducirse si se restringe el acceso a estos endpoints seg\u00fan las \"Directrices de seguridad para la implementaci\u00f3n en producci\u00f3n\", deshabilitando la exposici\u00f3n a redes no confiables."}], "lastModified": "2025-05-23T15:54:42.643", "sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}