CVE-2024-2323Medium· 4.8▾ SunlitThe RemoteUserStoreManagerService does not sufficiently validate password change attempts when the password history validation feature is enabled. This oversight allows an attacker to repeatedly attempt password guesses for a user accoun…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 26.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 20.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
0.2% → 0.2%
The RemoteUserStoreManagerService does not sufficiently validate password change attempts when the password history validation feature is enabled. This oversight allows an attacker to repeatedly attempt password guesses for a user account without being adequately restricted.
Exploiting this vulnerability enables an attacker to discover a user's password through brute force, leading to account impersonation. The success rate of such an attack is influenced by the complexity of the targeted user's password, with simpler passwords increasing the likelihood of compromise.
enterprise_integrator >= 6.6.0 < 6.6.0.204identity_server >= 5.10.0 < 5.10.0.286identity_server >= 5.11.0 < 5.11.0.344identity_server >= 6.0.0 < 6.0.0.188identity_server >= 6.1.0 < 6.1.0.150identity_server >= 7.0.0 < 7.0.0.35api_manager >= 3.1.0 < 3.1.0.268api_manager >= 3.2.0 < 3.2.0.354open_banking_am >= 2.0.0 < 2.0.0.315identity_server_as_key_manager >= 5.10.0 < 5.10.0.283open_banking_iam >= 2.0.0 < 2.0.0.335org.wso2.carbon:org.wso2.carbon.user.core >= 4.5.0 < 4.5.0.4org.wso2.carbon:org.wso2.carbon.user.core >= 4.5.3 < 4.5.3.34org.wso2.carbon:org.wso2.carbon.user.core >= 4.6.0 < 4.6.0.137org.wso2.carbon:org.wso2.carbon.user.core >= 4.6.1 < 4.6.1.111org.wso2.carbon:org.wso2.carbon.user.core >= 4.7.1 < 4.7.1.51org.wso2.carbon:org.wso2.carbon.user.core >= 4.9.0 < 4.9.0.54org.wso2.carbon:org.wso2.carbon.user.core >= 4.10.9 < 4.10.9.20Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3217/#solution
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-5139Medium· 6.1Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and Redirection
CVE-2024-4412Low· 2.7Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations
CVE-2024-4457Critical· 9.1Remote Code Execution via JDBC User Store Configuration in Multiple WSO2 Products Allows Arbitrary Code Execution
CVE-2024-6423Medium· 4.0Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information Leakage
CVE-2024-5563Medium· 4.8Incomplete reCaptcha Implementation in Authentication Flows in WSO2 Identity Server Allows Brute Force Attacks
CVE-2024-4989Medium· 5.4Open Redirection via Callback URL in WSO2 API Manager Allows Phishing Attacks