Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2024-2323— Password Brute Force via Password History Validation in Multiple WSO2 Products Allows User Account Discovery

Quick assessment

Affected
WSO2 WSO2 Enterprise Integrator
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

当启用密码历史验证功能时，RemoteUserStoreManagerService 未对密码修改请求进行充分的验证。这一缺陷使得攻击者能够针对用户账户反复尝试密码猜测，而不会受到有效限制。 利用该漏洞，攻击者可通过暴力破解方式获取用户密码，进而实现账户冒充。此类攻击的成功率取决于目标用户密码的复杂度：密码越简单，被破解的风险越高。

CVSS 4.8 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-2323

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Password Brute Force via Password History Validation in Multiple WSO2 Products Allows User Account Discovery
Source: CVE Program / CVE List V5
Vulnerability Description
The RemoteUserStoreManagerService does not sufficiently validate password change attempts when the password history validation feature is enabled. This oversight allows an attacker to repeatedly attempt password guesses for a user account without being adequately restricted. Exploiting this vulnerability enables an attacker to discover a user's password through brute force, leading to account impersonation. The success rate of such an attack is influenced by the complexity of the targeted user's password, with simpler passwords increasing the likelihood of compromise.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
过多认证尝试的限制不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
WSO2 WSO2 Enterprise Integrator 6.6.0 ~ 6.6.0.204 -
WSO2 WSO2 Identity Server 5.10.0 ~ 5.10.0.286 -
WSO2 WSO2 API Manager 3.1.0 ~ 3.1.0.268 -
WSO2 WSO2 Open Banking AM 2.0.0 ~ 2.0.0.315 -
WSO2 WSO2 Identity Server as Key Manager 5.10.0 ~ 5.10.0.283 -
WSO2 WSO2 Open Banking IAM 2.0.0 ~ 2.0.0.335 -
WSO2 WSO2 Carbon User Manager Kernel 4.5.0 ~ 4.5.0.4 -

II. Public POCs for CVE-2024-2323

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-2323

请登录查看更多情报信息。

Other References for CVE-2024-2323 (1)

IV. Related Vulnerabilities

Same product: WSO2 Enterprise Integrator
Same vendor: WSO2
Same weakness: CWE-307

V. Comments for CVE-2024-2323

No comments yet

Leave a comment