WSO2 · Multiple Products
CVE-2022-29464
WSO2 Multiple Products Unrestrictive Upload of File Vulnerability
What it is
Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps directory. This affects WSO2 API Manager 2.2.0 up to 4.0.0, WSO2 Identity Server 5.2.0 up to 5.11.0, WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0 and 5.6.0, WSO2 Identity Server as Key Manager 5.3.0 up to 5.11.0, WSO2 Enterprise Integrator 6.2.0 up to 6.6.0, WSO2 Open Banking AM 1.4.0 up to 2.0.0 and WSO2 Open Banking KM 1.4.0, up to 2.0.0.
CISA: Multiple WSO2 products allow for unrestricted file upload, resulting in remote code execution.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: May 16, 2022
- Added to the CISA list
- April 25, 2022
- Published
- April 18, 2022
- Severity
- Critical 9.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- >99.9% in the top 0.1% of all known vulnerabilities
- Weakness
- CWE-22
- More details
- NVD · CVE.org · CISA
All references (4)
More exploited flaws from WSO2
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Sep 24, 2026 | Path Traversal Vulnerability | Multiple Products | Critical 10.0 | 22% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.