CVE-2024-4457: WSO2 Enterprise Integrator 6.6.0 to before 6.6.0.204; +6 more affected products

Affected technology

WSO2 Enterprise Integrator · 6.6.0 to before 6.6.0.204
WSO2

WSO2 API Manager · 3.1.0 to before 3.1.0.275, 3.2.0 to before 3.2.0.365, 3.2.1 to before 3.2.1.19, 4.0.0 to before 4.0.0.308, 4.1.0 to before 4.1.0.170, 4.2.0 to before 4.2.0.107, 4.3.0 to before 4.3.0.21
WSO2

WSO2 Open Banking AM · 2.0.0 to before 2.0.0.325
WSO2

WSO2 Open Banking IAM · 2.0.0 to before 2.0.0.345
WSO2

WSO2 Identity Server as Key Manager · 5.10.0 to before 5.10.0.292
WSO2

WSO2 Identity Server · 5.10.0 to before 5.10.0.296, 5.11.0 to before 5.11.0.336, 6.0.0 to before 6.0.0.188, 6.1.0 to before 6.1.0.148, 7.0.0 to before 7.0.0.15
WSO2

WSO2 Carbon User Manager Kernel · 4.5.0 to before 4.5.0.4, 4.5.3 to before 4.5.3.34, 4.6.0 to before 4.6.0.141, 4.6.1 to before 4.6.1.108, 4.6.2 to before 4.6.2.610, 4.6.3 to before 4.6.3.23, 4.6.4 to before 4.6.4.5, 4.7.1 to before 4.7.1.51, 4.8.1 to before 4.8.1.23, 4.9.0 to before 4.9.0.54, 4.9.26 to before 4.9.26.13, 4.10.9 to before 4.10.9.10
WSO2

Component: Not specified by the source

What an attacker can do

An attacker can supply specially crafted input that can lead to the execution of arbitrary code on the affected server.