# CVE-2024-7097: WS02 - Authorization Bypass

> Live exploitation tracking for CVE-2024-7097 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2024-7097

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **Public exploit available:** Yes
- **Affected products:** WSO2
- **Weaknesses:** CWE-863 (Incorrect Authorization)

## Description

The SOAP admin service in WSO2 products has a security vulnerability that allows the creation of new user accounts regardless of the self-registration configuration settings.

## CrowdSec analysis

[CVE-2024-7097](https://euvd.enisa.europa.eu/vulnerability/CVE-2024-7097) is a vulnerability in the SOAP admin service of WSO2 products, enabling attackers to create new user accounts regardless of self-registration settings.

CrowdSec has been tracking this vulnerability and its exploits since 5th of March 2025.

Data from the CrowdSec community indicates that exploitation of CVE-2024-7097 is highly selective and intelligence-driven. Threat actors use advanced reconnaissance and carefully choose their targets, often as part of sophisticated campaigns or advanced persistent threat operations.
In addition, according to the CrowdSec network, attack volume against CVE-2024-7097 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Observed exploitation attempts typically target URLs containing `/services/userregistrationadminservice.userregistrationadminservicehttpssoap11endpoint`.

## Timeline

- 2024-10-12: CVE Published. CVE-2024-7097 is published to NVD.
- 2025-03-05: Rule Released. CrowdSec releases a rule to detect CVE-2024-7097 exploitation attempts against the CrowdSec Network.
- 2025-03-06: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2024-7097 for the first time.

## References

- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-7097.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2024-7097) follows observed exploitation activity for CVE-2024-7097. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.