Critical severity · published Apr 18, 2022
CVE-2022-29464
WSO2 Multiple Products Unrestrictive Upload of File Vulnerability
RansomwareIn wildKEV
9.8
CVSS
100%
EPSS
Yes
On KEV
Description
Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps directory. This affects WSO2 API Manager 2.2.0 up to 4.0.0, WSO2 Identity Server 5.2.0 up to 5.11.0, WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0 and 5.6.0, WSO2 Identity Server as Key Manager 5.3.0 up to 5.11.0, WSO2 Enterprise Integrator 6.2.0 up to 6.6.0, WSO2 Open Banking AM 1.4.0 up to 2.0.0 and WSO2 Open Banking KM 1.4.0, up to 2.0.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)100.0% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Apr 25, 2022
Federal remediation dueMay 16, 2022
Ransomware campaign useKnown
Affected products
Which versions
AM
Api Manager · Wso2
2.2.0 through 4.0.0 · source: NVD
EI
Enterprise Integrator · Wso2
6.2.0 through 6.6.0 · source: NVD
IS
Identity Server · Wso2
5.2.0 through 5.11.0 · source: NVD
IS
Identity Server AS Key Manager · Wso2
5.3.0 through 5.10.0 · source: NVD
IS
Identity Server Analytics · Wso2
5.4.0; 5.4.1; 5.5.0; 5.6.0 · source: NVD
OB
Open Banking AM · Wso2
1.3.0 through 2.0.0 · source: NVD
OB
Open Banking Iam · Wso2
2.0.0 · source: NVD
OB
Open Banking KM · Wso2
1.3.0 through 1.5.0 · source: NVD
MP
Multiple Products · WSO2
All versions, or not specified · source: KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-29464
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-29464
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
mailing-list
http://www.openwall.com/lists/oss-security/2022/04/22/7
github.com
https://github.com/hakivvi/CVE-2022-29464
packetstormsecurity.com
http://packetstormsecurity.com/files/166921/WSO-Arbitrary-File-Upload-Remote-Code-Execution.html
security.docs.wso2.com
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2022/WSO2-2021-1738/
More from Api Manager
10.0
CVE-2026-5430
Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover
10.0
CVE-2026-2053
Unauthenticated Server-Side Request Forgery via WS-Addressing in WSO2 API Manager
9.8
CVE-2026-1728
Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover
9.8
CVE-2025-9312
A missing authentication enforcement vulnerability exists in the mutual TLS (mTLS) implementation used by System REST APIs and SOAP services in multiple WSO2 products
9.8
CVE-2025-9152
An improper privilege management vulnerability exists in WSO2 API Manager due to missing authentication and authorization checks in the keymanager-operations Dynamic Client…