Is CVE-2022-29464 actively exploited?

CVE-2022-29464 has no public evidence of in-the-wild exploitation as of 2025-11-07.

What is the CVSS score for CVE-2022-29464?

CVE-2022-29464 has a CVSS score of 9.8 (CRITICAL severity). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

How do I patch CVE-2022-29464?

Patch guidance is available from wso2 security advisories. CVEDatabase generates AI-assisted remediation guidance on demand for CVE-2022-29464.

Fix CVE-2022-29464 - CRITICAL wso2 api manager

Q: Which products are affected by CVE-2022-29464?

11 products: wso2 api manager, wso2 enterprise integrator, wso2 identity server, wso2 identity server analytics, wso2 identity server analytics, and 6 more.

Description

Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps directory. This affects WSO2 API Manager 2.2.0 up to 4.0.0, WSO2 Identity Server 5.2.0 up to 5.11.0, WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0 and 5.6.0, WSO2 Identity Server as Key Manager 5.3.0 up to 5.11.0, WSO2 Enterprise Integrator 6.2.0 up to 6.6.0, WSO2 Open Banking AM 1.4.0 up to 2.0.0 and WSO2 Open Banking KM 1.4.0, up to 2.0.0.

CVSS Metrics

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector: network
Complexity: low
Privileges: none
User Action: none
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high
Weaknesses: CWE-22 · Path Traversal CWE-22 · Path Traversal

Metadata

Primary Vendor: WSO2
Published: 4/18/2022
Last Modified: 11/7/2025
Source: NIST NVD
Note: Verify all details with official vendor sources before applying patches.

Affected Products

wso2 : api_managerwso2 : enterprise_integratorwso2 : identity_serverwso2 : identity_server_analyticswso2 : identity_server_analyticswso2 : identity_server_analyticswso2 : identity_server_analyticswso2 : identity_server_as_key_managerwso2 : open_banking_amwso2 : open_banking_iamwso2 : open_banking_km

Remediation Guidance

Executive Summary

View on NIST NVD