CVE-2022-29464
Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to re...
Affects 8 products across 1 vendor.
Attacker manipulates file path inputs to access files outside the intended directory.
Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.
CVE-2022-29464 affects multiple WSO2 products, allowing an attacker to perform remote code execution via unrestricted file upload. The vulnerability is critical due to its high CVSS score and the availability of a public proof-of-concept. Immediate action is required to mitigate the risk of exploitation.
BSID: BS-2022-GLOBAL-278093-C • Model: Qwen/Qwen2.5-72B-Instruct-AWQ • Confidence: HIGH
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2022-29464?
What is the CVSS score for CVE-2022-29464?
Is CVE-2022-29464 actively exploited?
How do I remediate CVE-2022-29464?
What systems are affected by CVE-2022-29464?
What NERC-CIP standard applies to CVE-2022-29464?
What IEC 62443 requirement maps to CVE-2022-29464?
| CVE ID | CVE-2022-29464 |
|---|---|
| BSID | BS-2022-GLOBAL-278093-C BreachSpider Global ID |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Published | 2022-04-18 |
| Last Modified | 2026-06-17 |
| ICS Relevance | 15% |
| Weakness (CWE) | |
| Source | NVD |
Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps directory. This affects WSO2 API Manager 2.2.0 up to 4.0.0, WSO2 Identity Server 5.2.0 up to 5.11.0, WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0 and 5.6.0, WSO2 Identity Server as Key Manager 5.3.0 up to 5.11.0, WSO2 Enterprise Integrator 6.2.0 up to 6.6.0, WSO2 Open Banking AM 1.4.0 up to 2.0.0 and WSO2 Open Banking KM 1.4.0, up to 2.0.0.
Source: NIST NVD / MITRE CVE Database
The vulnerability allows an attacker to upload files to a directory under the web root by using a /fileupload endpoint with a Content-Disposition directory traversal sequence. This can lead to remote code execution if the uploaded file contains malicious code.
Exploitation Likelihood: CRITICAL
| Vendor | Product | Affected Versions |
|---|---|---|
| Wso2 | Identity Server | ≥ 5.2.0, ≤ 5.11.0 |
| Wso2 | Api Manager | ≥ 2.2.0, ≤ 4.0.0 |
| Wso2 | Enterprise Integrator | ≥ 6.2.0, ≤ 6.6.0 |
| Wso2 | Identity Server As Key Manager | ≥ 5.3.0, ≤ 5.10.0 |
| Wso2 | Identity Server Analytics | 5.4.0 5.4.1 5.5.0 5.6.0 |
| Wso2 | Open Banking Am | ≥ 1.3.0, ≤ 2.0.0 |
| Wso2 | Open Banking Iam | 2.0.0 |
| Wso2 | Open Banking Km | ≥ 1.3.0, ≤ 1.5.0 |
| CISA known-exploited | ● Active Exploitation Confirmed (added 2022-04-25) |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
Implement strict file upload restrictions and validate all file uploads to prevent directory traversal and remote code execution. Ensure that only authorized users can access the /fileupload endpoint.
No reliable network detection signature exists for this vulnerability class — apply the compensating controls above and the vendor patch. A network rule is only drafted when a concrete on-the-wire signature can be grounded in the advisory.
This CVE violates CIP-007-R2 because it allows unauthorized access to the system, which could compromise the integrity and availability of critical assets.
This CVE maps to SR 7.6 because it involves a vulnerability in the application layer that could be exploited to gain unauthorized access and execute arbitrary code, compromising the security of the industrial control system.
Drafted by AI and not validated for your network. Test in an isolated environment before any production deployment. Compensating control only - does not replace vendor patch.
AI Enrichment Record — provenance & audit hash
| Model | Qwen/Qwen2.5-72B-Instruct-AWQ |
|---|---|
| Confidence | HIGH |
| Enriched At | 2026-05-24 |
| SHA-512 Audit Hash | c97f793c593e1bc5f70c3d59ff91031fe1e4eb68d3325afd9de1953aa3b3b9897ea3e88e0ebdc86795f4ad4fafd64f1dc12eacb5834c77f20e0cc01b07004493 |
This Vulnerability Is Being Actively Exploited
CVE-2022-29464 is on the CISA known-exploited list - confirmed active exploitation in the wild. BreachSpider flags known-exploited CVEs on the ICS assets they affect, with known-exploited status synced daily from CISA.
Create a free account →