CVE-2024-7073: WSO2 Identity Server as Key Manager · Server-Side Request Forgery (SSRF)
Affects WSO2 Identity Server as Key ManagerSource CVE Database V5
Not known to be exploited · CVSS 6.5 Medium.
Data as of 26 Oct 2026, 09:15 UTC
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 12% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 2 Jun 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
Mavenorg.wso2.identity/wso2-identity-server-key-managerpkg:maven/org.wso2.identity/wso2-identity-server-key-managerOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
1. Immediate network-level controls: Restrict outbound network traffic from the WSO2 Identity Server to only necessary destinations using firewall rules or network segmentation to limit the potential for SSRF exploitation. 2. Input validation and filtering: Implement strict validation on all incoming SOAP admin service requests, ensuring that URLs or IP addresses provided by clients are sanitized and restricted to safe, whitelisted ranges. 3. Disable or restrict SOAP admin services if not required: If the SOAP admin interface is not essential for operational purposes, disable it or restrict access to trusted administrative networks only. 4. Monitor and log: Enable detailed logging of all SOAP admin service requests and monitor for unusual or suspicious request patterns that could indicate exploitation attempts. 5. Patch management: Stay alert for official patches or updates from WSO2 addressing this vulnerability and apply them promptly once available. 6. Use Web Application Firewalls (WAFs): Deploy WAFs with rules designed to detect and block SSRF attack patterns targeting SOAP services. 7. Conduct internal penetration testing and vulnerability assessments focusing on SSRF vectors within the IAM infrastructure to proactively identify and remediate weaknesses.
Description
A server-side request forgery (SSRF) vulnerability exists in multiple WSO2 products due to improper input validation in SOAP admin services. This flaw allows unauthenticated attackers to manipulate server-side requests, enabling access to internal and external resources available through the network or filesystem. Exploitation of this vulnerability could lead to unauthorized access to sensitive data and systems, including resources within private networks, as long as they are reachable by the affected product.