CVE-2024-2323: The RemoteUserStoreManagerService does not sufficiently validate password change attempts when the password history validation feature is enabled. This…

PriorityP428medium4.8CVSS 3.1

AVNACHPRNUINSUCLILAN

EPSS

0.17%

5.8th percentile

The RemoteUserStoreManagerService does not sufficiently validate password change attempts when the password history validation feature is enabled. This oversight allows an attacker to repeatedly attempt password guesses for a user account without being adequately restricted. Exploiting this vulnerability enables an attacker to discover a user's password through brute force, leading to account impersonation. The success rate of such an attack is influenced by the complexity of the targeted user's password, with simpler passwords increasing the likelihood of compromise.

Affected

18 ranges

Vendor	Product	Version range	Fixed in
wso2	wso2_api_manager	>= 3.1.0 < 3.1.0.268	3.1.0.268
wso2	wso2_api_manager	>= 3.2.0 < 3.2.0.354	3.2.0.354
wso2	wso2_carbon_user_manager_kernel	>= 4.10.9 < 4.10.9.20	4.10.9.20
wso2	wso2_carbon_user_manager_kernel	>= 4.5.0 < 4.5.0.4	4.5.0.4
wso2	wso2_carbon_user_manager_kernel	>= 4.5.3 < 4.5.3.34	4.5.3.34
wso2	wso2_carbon_user_manager_kernel	>= 4.6.0 < 4.6.0.137	4.6.0.137
wso2	wso2_carbon_user_manager_kernel	>= 4.6.1 < 4.6.1.111	4.6.1.111
wso2	wso2_carbon_user_manager_kernel	>= 4.7.1 < 4.7.1.51	4.7.1.51
wso2	wso2_carbon_user_manager_kernel	>= 4.9.0 < 4.9.0.54	4.9.0.54
wso2	wso2_enterprise_integrator	>= 6.6.0 < 6.6.0.204	6.6.0.204
wso2	wso2_identity_server	>= 5.10.0 < 5.10.0.286	5.10.0.286
wso2	wso2_identity_server	>= 5.11.0 < 5.11.0.344	5.11.0.344
wso2	wso2_identity_server	>= 6.0.0 < 6.0.0.188	6.0.0.188
wso2	wso2_identity_server	>= 6.1.0 < 6.1.0.150	6.1.0.150
wso2	wso2_identity_server	>= 7.0.0 < 7.0.0.35	7.0.0.35
wso2	wso2_identity_server_as_key_manager	>= 5.10.0 < 5.10.0.283	5.10.0.283
wso2	wso2_open_banking_am	>= 2.0.0 < 2.0.0.315	2.0.0.315
wso2	wso2_open_banking_iam	>= 2.0.0 < 2.0.0.335	2.0.0.335

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.