{"id":"CVE-2024-4457","published":"2026-10-18T18:16:28Z","modified":"2026-10-27T19:10:00Z","title":"The Management Console fails to properly validate input related to the configuration of JDBC user stores","vendor":"WSO2","product":"WSO2 Enterprise Integrator","tier":"core","eol":null,"description":{"text":"The Management Console fails to properly validate input related to the configuration of JDBC user stores. This weakness allows an attacker to supply specially crafted input that can lead to the execution of arbitrary code on the affected server.\n\nSuccessful exploitation of this vulnerability enables an attacker to execute arbitrary code on the server with the privileges of the WSO2 product. This could lead to a full compromise of the system.","provenance":"source","from":"NVD"},"summary":{"text":"The Management Console of WSO2 Enterprise Integrator fails to properly validate input used when configuring JDBC user stores, which is an OS command injection weakness. An attacker with network access to the console, requiring no authentication and no user interaction, can submit specially crafted input to execute arbitrary code on the server with the privileges of the WSO2 product, potentially leading to full system compromise.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:19:56Z"},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.00417,"percentile":0.35942,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":4,"pulses":[{"name":"Known_Cve | Oct 27, 2026 | Part 1/3","url":"https://otx.alienvault.com/pulse/6adf68beabc3bad24a2b7cc6","created":"2026-10-26"},{"name":"Known_Cve | Oct 24, 2026 | Part 1/3","url":"https://otx.alienvault.com/pulse/6adb7414397c3ad4799aa4ce","created":"2026-10-23"},{"name":"Known_Cve | Oct 23, 2026 | Part 2/3","url":"https://otx.alienvault.com/pulse/6ada237de8198eb6a6cbfac4","created":"2026-10-22"},{"name":"Known_Cve | Oct 22, 2026 | Part 3/4","url":"https://otx.alienvault.com/pulse/6ad8d34cb141a6cceeba88be","created":"2026-10-21"}],"provenance":"machine"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"https://github.com/wso2/carbon-kernel/pull/4067","tags":[]},{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2023-3084/","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-55805","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-55805","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-18","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-4457","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":15.1,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":7.19,"detail":"percentile 0.3594"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":1.59,"detail":"4 pulses"},{"name":"CVSS severity","points":6.37,"detail":"base score 9.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}