CVE-2024-6914
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedAn incorrect authorization vulnerability exists in multiple WSO2 products due to a business logic flaw in the account recovery-related SOAP admin service. A malicious actor can exploit this vulnerability to reset the password of any user account, leading to a complete account takeover, including accounts with elevated privileges. This vulnerability is exploitable only through the account recovery SOAP admin services exposed via the "/services" context path in affected products. The impact may be reduced if access to these endpoints has been restricted based on the "Security Guidelines for Production Deployment" by disabling exposure to untrusted networks.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceA business logic flaw in WSO2's account recovery SOAP admin services allows unauthorized password resets for any user account, including privileged accounts, through endpoints exposed via the '/services' context path.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data= 2.2.0= 2.5.0= 2.6.0= 3.0.0= 3.1.0= 3.2.0= 3.2.1= 4.0.0= 4.1.0= 4.2.0= 4.3.0= 5.3.0= 5.4.0= 5.4.1= 5.5.0= 5.6.0= 5.7.0= 5.8.0= 5.9.0= 5.10.0= 5.11.0= 6.0.0= 6.1.0= 5.3.0= 5.5.0= 5.6.0= 5.7.0= 5.9.0= 5.10.0= 1.3.0= 1.4.0= 1.5.0= 2.0.0= 2.0.0= 1.3.0= 1.4.0= 1.5.0CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify WSO2 product and versionLocate the version file in the installation directory. Check <product-home>/repository/components/VERSION or examine the carbon.xml file in <product-home>/repository/conf/carbon.xml for the <Version> element. Alternatively, log into the admin console and navigate to Monitor > System Statistics > Server Details to view the product name and version.Affected if The installed product matches one of the affected products (WSO2 API Manager, Identity Server, Identity Server As Key Manager, Open Banking AM, Open Banking IAM, or Open Banking KM) AND the version matches an affected version listed in the CVE advisory.
-
Verify account recovery SOAP admin services are exposedAccess the WSDL for account recovery services by navigating to https://<host>:<port>/services/AccountRecoveryService?wsdl or https://<host>:<port>/services/AccountRecoveryService?services or test with a SOAP request to these endpoints. Confirm the services are listed and accessible.Affected if The AccountRecoveryService or related account recovery SOAP admin services are accessible via the '/services' context path.
-
Confirm network exposure of '/services' endpointDetermine if the '/services' endpoint is bound to an IP address accessible from untrusted networks. Check the server.xml in <product-home>/repository/conf/tomcat/catalina-server.xml for the Connector binding, and verify firewall rules or load balancer configurations allow external access to port 443 or 9443 for the '/services' path.Affected if The '/services' endpoint hosting account recovery SOAP admin services is exposed to untrusted networks (internet-accessible) without network-level access controls.
A user is affected if they run a listed WSO2 product version AND have account recovery SOAP admin services exposed via the '/services' path accessible from untrusted networks.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scopedRestrict access to the account recovery SOAP admin services by disabling exposure to untrusted networks per the Security Guidelines for Production Deployment, or implement network-level access controls to limit access to trusted IPs only.
- Restrict network access to the /services endpoint to trusted networks only, following the WSO2 Security Guidelines for Production Deployment
- Disable exposure of the account recovery SOAP admin services to untrusted networks by configuring network firewall rules or API gateway policies
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation2.0 h
- Implementation2.0 h
- Testing1.0 h
- Review / QA1.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $1,744.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2024-6914 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2024-6914 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data