CVE-2022-29464

Confirmed PUBLISHED

Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a...

WSO2 · WSO2 API Manager, WSO2 Identity Server, WSO2 Identity Server Analytics, WSO2 Enterprise Integrator, WSO2 Open Banking AM, WSO2 Open Banking KM

Exploited in the wild Used in malware PoC available

Recommended Action

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

View KEV Feed Talk to Sales

Confidence

Confirmed

Exploitation Status

Exploited in the wild

Observed in Sensors

Attempts (30d)

—

Unique Attacker IPs

—

CISA KEV

In CISA KEV

CVSS / EPSS

9.8 Critical EPSS 100.0%

At a Glance

Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps directory. This affects WSO2 API Manager 2.2.0 up to 4.0.0, WSO2 Identity Server 5.2.0 up to 5.11.0, WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0 and 5.6.0, WSO2 Identity Server as Key Manager 5.3.0 up to 5.11.0, WSO2 Enterprise Integrator 6.2.0 up to 6.6.0, WSO2 Open Banking AM 1.4.0 up to 2.0.0 and WSO2 Open Banking KM 1.4.0, up to 2.0.0.

ransomware metasploit malware cisa nuclei_scanner

CVE Published: Apr 18, 2022
Exploitation Reported: Apr 25, 2022
CVSS: 9.8 Critical
EPSS: 100.0%

Remote Low complexity No user interaction Unauthenticated

Affected Versions

Vendor	Product	Version	Status
n/a	n/a	n/a	Affected

CVE References

[oss-security] 20220422 CVE-2022-29464 :: WSO2 Unrestricted arbitrary file upload, and remote code to execution vulnerability. openwall.com · Mailing List http://www.openwall.com/lists/oss-security/2022/04/22/7
GitHub — hakivvi/CVE-2022-29464 github.com · CVE Record https://github.com/hakivvi/CVE-2022-29464
packetstormsecurity.com/files/166921/WSO-Arbitrary-File-Upload-Remot... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/166921/WSO-Arbitrary-File-Upload...
security.docs.wso2.com/en/latest/security-announcements/security-ad... security.docs.wso2.com · CVE Record https://security.docs.wso2.com/en/latest/security-announcements/secur...

Recommended Actions

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.
Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
CISA First	2022-04-25 00:00 UTC
The Shadowserver	2026-07-08 00:00 UTC

Scanner Artifacts

Nuclei and Metasploit references linked to this CVE.

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-29464.yaml	Apr 25, 2025
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/wso2_file_upload_rce.rb	Apr 28, 2025

CVSS Scores

CVSS v3.1 9.8 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 10.0 High

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitation Status

Exploited in the wild

Recorded 2022-04-25 00:00:00 UTC · CISA

Used in malware

Recorded 2022-04-25 00:00:00 UTC · CISA

Proof of concept available

Recorded 2022-04-20 21:23:52 UTC · GitHub

Weaknesses (CWE)

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Scanner Integrations

Scanner	Reference	Detected
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/wso2_file_upload_rce.rb	Apr 28, 2025
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-29464.yaml	Apr 25, 2025

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

Pushkarup/CVE-2022-29464

github · Created 2023-10-24 18:54:09 UTC · 1 stars

A PoC and Exploit for CVE 2022-29464

ThatNotEasy/CVE-2022-29464

github · Created 2023-04-25 09:45:18 UTC · 6 stars

Perform With Mass Exploits In WSO Management.

gbrsh/CVE-2022-29464

github · Created 2022-11-14 18:22:41 UTC · 7 stars

RCE exploit for WSO2

hupe1980/CVE-2022-29464

github · Created 2022-09-22 14:04:49 UTC · 3 stars

WSO2 Arbitrary File Upload to Remote Command Execution (RCE)

amit-pathak009/CVE-2022-29464-mass

github · Created 2022-08-13 18:15:18 UTC · 1 stars

r4x0r1337/-CVE-2022-29464

github · Created 2022-08-01 07:27:29 UTC · 4 stars

g0dxing/CVE-2022-29464

github · Created 2022-06-28 01:10:41 UTC · 0 stars

Python script to exploit CVE-2022-29464 (mass mode)

jimidk/Better-CVE-2022-29464

github · Created 2022-06-04 16:46:52 UTC · 4 stars

CVE-2022-29464 PoC for WSO2 products

Chocapikk/CVE-2022-29464

github · Created 2022-05-26 20:19:53 UTC · 3 stars

Python script to exploit CVE-2022-29464 (mass mode)

Inplex-sys/CVE-2022-29464-loader

github · Created 2022-05-15 08:51:16 UTC · 10 stars

A bots loader for CVE-2022-29464 with multithreading

superzerosec/CVE-2022-29464

github · Created 2022-04-29 08:24:17 UTC · 2 stars

CVE-2022-29464 POC exploit

gpiechnik2/nmap-CVE-2022-29464

github · Created 2022-04-22 21:23:57 UTC · 3 stars

Repository containing nse script for vulnerability CVE-2022-29464 known as WSO2 RCE.

hev0x/CVE-2022-29464

github · Created 2022-04-22 05:19:51 UTC · 3 stars

WSO2 RCE (CVE-2022-29464)

mr-r3bot/WSO2-CVE-2022-29464

github · Created 2022-04-21 14:47:18 UTC · 2 stars

Pre-auth RCE bug CVE-2022-29464

hakivvi/CVE-2022-29464

github · Created 2022-04-20 21:23:52 UTC · 372 stars

WSO2 RCE (CVE-2022-29464) exploit and writeup.

WSO2 Management - Arbitrary File Upload & Remote Code Execution

nuclei · Created Unknown

wso2_file_upload_rce

metasploit · Created Unknown

Metasploit module for CVE-2022-29464

Timeline

Key exploitation, disclosure, scanner coverage, and KEV attestation events for this CVE.

8 Jul 2026 00:00 UTC 11 days ago

8 Jul 2026 00:00 UTC · 11 days ago

KEV confirmed by The Shadowserver

Exploitation attested by an external source
28 Apr 2025 15:02 UTC about 1 year ago

28 Apr 2025 15:02 UTC · about 1 year ago

Metasploit module available

Exploit module available
25 Apr 2025 00:00 UTC about 1 year ago

25 Apr 2025 00:00 UTC · about 1 year ago

Nuclei template available

Scanner coverage available
25 Apr 2022 00:00 UTC about 4 years ago

25 Apr 2022 00:00 UTC · about 4 years ago

Added to CISA KEV

Listed in the CISA Known Exploited Vulnerabilities catalog
25 Apr 2022 00:00 UTC about 4 years ago

25 Apr 2022 00:00 UTC · about 4 years ago

First public exploitation report

Exploit observed in malware
20 Apr 2022 21:23 UTC about 4 years ago

20 Apr 2022 21:23 UTC · about 4 years ago

Public PoC available

Public proof-of-concept code published
18 Apr 2022 00:00 UTC over 4 years ago

18 Apr 2022 00:00 UTC · over 4 years ago

CVE published

Vulnerability disclosed publicly
18 Apr 2022 00:00 UTC over 4 years ago

18 Apr 2022 00:00 UTC · over 4 years ago

CVE ID reserved

Identifier reserved by the CNA

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2022-29464

{
  "cve_id": "CVE-2022-29464",
  "title": "Certain WSO2 products allow unrestricted file upload with resultant remote co...",
  "affected_vendor": "WSO2",
  "affected_product": "WSO2 API Manager, WSO2 Identity Server, WSO2 Identity Server Analytics, WSO2 Enterprise Integrator, WSO2 Open Banking AM, WSO2 Open Banking KM",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "Confirmed",
  "cvss_score": 9.8,
  "epss_score": 0.99999,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2022-29464

At a Glance

Affected Versions

CVE References

Recommended Actions

Known Exploited Vulnerability Sources

Scanner Artifacts

Virtual Patch

CVSS Scores

Exploitation Status

Weaknesses (CWE)

Scanner Integrations

Potential Proof of Concepts

Timeline

Automate This Intelligence with the Pro API