What’s Vulnerable › Vulnerabilities
CVE-2024-2323: Password Brute Force via Password History Validation in Multiple WSO2 Products Allows User Account Discovery
- Severity: medium (CVSS 4.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-20 · updated 2026-10-20
- Weakness: CWE-307
Description
The RemoteUserStoreManagerService does not sufficiently validate password change attempts when the password history validation feature is enabled. This oversight allows an attacker to repeatedly attempt password guesses for a user account without being adequately restricted. Exploiting this vulnerability enables an attacker to discover a user's password through brute force, leading to account impersonation. The success rate of such an attack is influenced by the complexity of the targeted user's password, with simpler passwords increasing the likelihood of compromise.
Affected products
- WSO2 API Manager: from 3.1.0 before 3.1.0.268; from 3.2.0 before 3.2.0.354 — fixed in 3.1.0.268, 3.2.0.354
- WSO2 Enterprise Integrator: from 6.6.0 before 6.6.0.204 — fixed in 6.6.0.204
- WSO2 Identity Server: from 5.10.0 before 5.10.0.286; from 5.11.0 before 5.11.0.344; from 6.0.0 before 6.0.0.188; from 6.1.0 before 6.1.0.150; from 7.0.0 before 7.0.0.35 — fixed in 5.10.0.286, 5.11.0.344, 6.0.0.188, 6.1.0.150, 7.0.0.35
- WSO2 Carbon User Manager Kernel: from 4.5.0 before 4.5.0.4; from 4.5.3 before 4.5.3.34; from 4.6.0 before 4.6.0.137; from 4.6.1 before 4.6.1.111; from 4.7.1 before 4.7.1.51; from 4.9.0 before 4.9.0.54 — fixed in 4.10.9.20, 4.5.0.4, 4.5.3.34, 4.6.0.137, 4.6.1.111, 4.7.1.51
- WSO2 Identity Server as Key Manager: from 5.10.0 before 5.10.0.283 — fixed in 5.10.0.283
- WSO2 Open Banking AM: from 2.0.0 before 2.0.0.315 — fixed in 2.0.0.315
- WSO2 Open Banking IAM: from 2.0.0 before 2.0.0.335 — fixed in 2.0.0.335
How to fix
Upgrade to a fixed version: WSO2 API Manager 3.1.0.268, 3.2.0.354; WSO2 Enterprise Integrator 6.6.0.204; WSO2 Identity Server 5.10.0.286, 5.11.0.344, 6.0.0.188, 6.1.0.150; WSO2 Carbon User Manager Kernel 4.10.9.20, 4.5.0.4, 4.5.3.34, 4.6.0.137; WSO2 Identity Server as Key Manager 5.10.0.283; WSO2 Open Banking AM 2.0.0.315; WSO2 Open Banking IAM 2.0.0.335. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2024-2323 or the next vulnerability affects your stack