{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3awso2identity_server_analytics5.4.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*","cpe:2.3:a:wso2:enterprise_integrator:*:*:*:*:*:*:*:*","cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*","cpe:2.3:a:wso2:identity_server_analytics:5.4.0:*:*:*:*:*:*:*","cpe:2.3:a:wso2:identity_server_analytics:5.4.1:*:*:*:*:*:*:*","cpe:2.3:a:wso2:identity_server_analytics:5.5.0:*:*:*:*:*:*:*","cpe:2.3:a:wso2:identity_server_analytics:5.6.0:*:*:*:*:*:*:*","cpe:2.3:a:wso2:identity_server_as_key_manager:*:*:*:*:*:*:*:*","cpe:2.3:a:wso2:open_banking_am:*:*:*:*:*:*:*:*","cpe:2.3:a:wso2:open_banking_iam:2.0.0:*:*:*:*:*:*:*","cpe:2.3:a:wso2:open_banking_km:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2022-29464"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Manager (\u003c= 4.0.0)","Enterprise Integrator (\u003c= 6.6.0)","Identity Server (\u003c= 5.11.0)","Identity Server Analytics (5.4.0, 5.4.1, 5.5.0, 5.6.0)"],"_cs_severities":["critical"],"_cs_tags":["web-application-vulnerability","remote-code-execution","arbitrary-file-upload","cve-2022-29464"],"_cs_type":"advisory","_cs_vendors":["WSO2"],"content_html":"\u003cp\u003eCVE-2022-29464 is a critical vulnerability affecting multiple WSO2 products. The vulnerability exists within the \u003ccode\u003eFileUploadServlet\u003c/code\u003e component, which is incorrectly configured to skip authentication checks for requests directed at the \u003ccode\u003e/fileupload\u003c/code\u003e endpoint. This allows unauthenticated attackers to leverage the \u003ccode\u003eFileUploadExecutorManager\u003c/code\u003e to upload arbitrary files. By manipulating the \u003ccode\u003eContent-Disposition\u003c/code\u003e header with directory traversal sequences, an attacker can write files into the web application root, such as JSP shells, achieving Remote Code Execution (RCE).\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker sends an unauthenticated HTTP POST request to the \u003ccode\u003e/fileupload\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eCarbonUILoginUtil.handleLoginPageRequest()\u003c/code\u003e utility incorrectly identifies the \u003ccode\u003e/fileupload\u003c/code\u003e path as exempt from security checks and returns \u003ccode\u003eRETURN_TRUE\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eFileUploadServlet\u003c/code\u003e receives the request and passes it to the \u003ccode\u003eFileUploadExecutorManager\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe manager uses the \u003ccode\u003eactionString\u003c/code\u003e extracted from the URL to map the request to a specific \u003ccode\u003eFileUploadExecutor\u003c/code\u003e class.\u003c/li\u003e\n\u003cli\u003eThe attacker provides a \u003ccode\u003eContent-Disposition\u003c/code\u003e header containing directory traversal sequences (e.g., \u003ccode\u003e../../../../\u003c/code\u003e) to escape the intended upload directory.\u003c/li\u003e\n\u003cli\u003eThe application writes the uploaded JSP file into the web server deployment directory.\u003c/li\u003e\n\u003cli\u003eThe attacker requests the newly uploaded JSP file to trigger arbitrary code execution.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to achieve Remote Code Execution (RCE) on the underlying host, leading to full system compromise.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInventory all instances of WSO2 API Manager, Enterprise Integrator, Identity Server, and Identity Server Analytics.\u003c/li\u003e\n\u003cli\u003ePatch affected software to the versions remediating CVE-2022-29464 as provided by WSO2.\u003c/li\u003e\n\u003cli\u003eImplement network-level restrictions to block access to the \u003ccode\u003e/fileupload\u003c/code\u003e path for all untrusted users.\u003c/li\u003e\n\u003cli\u003eMonitor web server access logs for POST requests to \u003ccode\u003e/fileupload\u003c/code\u003e that contain directory traversal patterns (e.g., \u003ccode\u003e..%2F\u003c/code\u003e or \u003ccode\u003e../\u003c/code\u003e) in the request URI or parameters.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-29T12:27:25Z","date_published":"2026-10-29T12:27:25Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2022-29464/","summary":"CVE-2022-29464 is an unauthenticated arbitrary file upload vulnerability in the WSO2 FileUploadServlet that enables remote code execution via directory traversal and malicious JSP deployment.","title":"WSO2: Unauthenticated Remote Code Execution via FileUploadServlet (CVE-2022-29464)","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2022-29464/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:wso2:identity_server_analytics:5.4.0:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}