All vulnerabilities
CVE-2024-2323

Password Brute Force via Password History Validation in Multiple WSO2 Products Allows User Account Discovery

WSO2 WSO2 Enterprise Integrator
Open in ThreatlineRecord JSON
CVSS
4.8Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in6.6.0.204Also 5.10.0.286, 5.11.0.344 and 15 moreCVE List
Published20 Oct 2026Updated 20 Oct 2026CVE List

What fixes it

Show all 18 fixed versions
  • 3.1.0.268WSO2 API ManagerCVE List
  • 3.2.0.354WSO2 API ManagerCVE List
  • 2.0.0.315WSO2 Open Banking AMCVE List
  • 5.10.0.283WSO2 Identity Server as Key ManagerCVE List
  • 2.0.0.335WSO2 Open Banking IAMCVE List
  • 4.5.0.4WSO2 Carbon User Manager KernelCVE List
  • 4.5.3.34WSO2 Carbon User Manager KernelCVE List
  • 4.6.0.137WSO2 Carbon User Manager KernelCVE List
  • 4.6.1.111WSO2 Carbon User Manager KernelCVE List
  • 4.7.1.51WSO2 Carbon User Manager KernelCVE List
  • 4.9.0.54WSO2 Carbon User Manager KernelCVE List
  • 4.10.9.20WSO2 Carbon User Manager KernelCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The RemoteUserStoreManagerService does not sufficiently validate password change attempts when the password history validation feature is enabled. This oversight allows an attacker to repeatedly attempt password guesses for a user account without being adequately restricted.

Exploiting this vulnerability enables an attacker to discover a user's password through brute force, leading to account impersonation. The success rate of such an attack is influenced by the complexity of the targeted user's password, with simpler passwords increasing the likelihood of compromise.

Text from CVE List

Affected versions 24

  • WSO2 Enterprise Integratorunknown: all versions before 6.6.0CVE List
  • WSO2 Enterprise Integratoraffected: 6.6.0 before 6.6.0.204CVE List
  • WSO2 Identity Serverunknown: all versions before 5.10.0CVE List
  • WSO2 Identity Serveraffected: 5.10.0 before 5.10.0.286CVE List
  • WSO2 Identity Serveraffected: 5.11.0 before 5.11.0.344CVE List
  • WSO2 Identity Serveraffected: 6.0.0 before 6.0.0.188CVE List
  • WSO2 Identity Serveraffected: 6.1.0 before 6.1.0.150CVE List
  • WSO2 Identity Serveraffected: 7.0.0 before 7.0.0.35CVE List
  • WSO2 API Managerunknown: all versions before 3.1.0CVE List
  • WSO2 API Manageraffected: 3.1.0 before 3.1.0.268CVE List
  • WSO2 API Manageraffected: 3.2.0 before 3.2.0.354CVE List
  • WSO2 Open Banking AMunknown: all versions before 2.0.0CVE List
  • WSO2 Open Banking AMaffected: 2.0.0 before 2.0.0.315CVE List
  • WSO2 Identity Server as Key Managerunknown: all versions before 5.10.0CVE List
  • WSO2 Identity Server as Key Manageraffected: 5.10.0 before 5.10.0.283CVE List
  • WSO2 Open Banking IAMunknown: all versions before 2.0.0CVE List
  • WSO2 Open Banking IAMaffected: 2.0.0 before 2.0.0.335CVE List
  • WSO2 Carbon User Manager Kernelaffected: 4.5.0 before 4.5.0.4CVE List
  • WSO2 Carbon User Manager Kernelaffected: 4.5.3 before 4.5.3.34CVE List
  • WSO2 Carbon User Manager Kernelaffected: 4.6.0 before 4.6.0.137CVE List
  • WSO2 Carbon User Manager Kernelaffected: 4.6.1 before 4.6.1.111CVE List
  • WSO2 Carbon User Manager Kernelaffected: 4.7.1 before 4.7.1.51CVE List
  • WSO2 Carbon User Manager Kernelaffected: 4.9.0 before 4.9.0.54CVE List
  • WSO2 Carbon User Manager Kernelaffected: 4.10.9 before 4.10.9.20CVE List

References 1