Skip to content
CVE PROGRAM SOURCE RECORD5.9 Medium

CVE-2024-6832

Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WSO2

Description

The account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not maintain a consistent state for account locking if it cannot reach all configured user stores, allowing an attacker to repeatedly attempt authentication with invalid credentials without triggering the lockout mechanism for users within active stores. When the account locking mechanism is bypassed due to the inaccessibility of secondary user stores, users in accessible user stores are left vulnerable to brute force attacks. A malicious actor can exploit this by attempting numerous invalid password combinations against a user account without the expected account lockout consequence.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

WSO2 WSO2 Enterprise Integrator

Default version status: unaffected

  • 0 to < 6.6.0unknown
  • 6.6.0 to < 6.6.0.229affected

WSO2 WSO2 API Control Plane

Default version status: unaffected

  • 0 to < 4.5.0unknown
  • 4.5.0 to < 4.5.0.40affected
  • 4.6.0 to < 4.6.0.4affected
  • 4.6.0 to < 4.6.0.5affected

WSO2 WSO2 Traffic Manager

Default version status: unaffected

  • 0 to < 4.5.0unknown
  • 4.5.0 to < 4.5.0.38affected
  • 4.6.0 to < 4.6.0.4affected
  • 4.6.0 to < 4.6.0.5affected

WSO2 WSO2 Universal Gateway

Default version status: unaffected

  • 0 to < 4.5.0unknown
  • 4.5.0 to < 4.5.0.38affected
  • 4.6.0 to < 4.6.0.4affected
  • 4.6.0 to < 4.6.0.5affected

WSO2 WSO2 API Manager

Default version status: unaffected

  • 0 to < 3.1.0unknown
  • 3.1.0 to < 3.1.0.296affected
  • 3.2.0 to < 3.2.0.386affected
  • 3.2.0 to < 3.2.0.455affected
  • 3.2.1 to < 3.2.1.74affected
  • 4.1.0 to < 4.1.0.238affected
  • 4.2.0 to < 4.2.0.179affected
  • 4.3.0 to < 4.3.0.91affected
  • 4.4.0 to < 4.4.0.55affected
  • 4.5.0 to < 4.5.0.39affected
  • 4.6.0 to < 4.6.0.4affected

WSO2 WSO2 Identity Server

Default version status: unaffected

  • 0 to < 5.10.0unknown
  • 5.10.0 to < 5.10.0.320affected
  • 5.11.0 to < 5.11.0.427affected
  • 6.0.0 to < 6.0.0.254affected
  • 6.1.0 to < 6.1.0.195affected
  • 7.0.0 to < 7.0.0.82affected

WSO2 WSO2 Identity Server as Key Manager

Default version status: unaffected

  • 0 to < 5.10.0unknown
  • 5.10.0 to < 5.10.0.314affected

WSO2 WSO2 Open Banking IAM

Default version status: unaffected

  • 0 to < 2.0.0unknown
  • 2.0.0 to < 2.0.0.366affected

WSO2 WSO2 Open Banking AM

Default version status: unaffected

  • 0 to < 2.0.0unknown
  • 2.0.0 to < 2.0.0.345affected

WSO2 WSO2 Carbon User Manager Kernel

Default version status: unknown

  • 4.5.0 to < 4.5.0.7affected
  • 4.5.3 to < 4.5.3.53affected
  • 4.6.0 to < 4.6.0.196affected
  • 4.6.1 to < 4.6.1.163affected
  • 4.6.1 to < 4.6.1.164affected
  • 4.6.3 to < 4.6.3.44affected
  • 4.6.4 to < 4.6.4.25affected
  • 4.7.1 to < 4.7.1.77affected
  • 4.7.1 to < 4.7.1.78affected
  • 4.8.1 to < 4.8.1.46affected
  • 4.9.26 to < 4.9.26.33affected
  • 4.9.27 to < 4.9.27.19affected
  • 4.9.28 to < 4.9.28.21affected
  • 4.9.33 to < 4.9.33.4affected
  • 4.10.9 to < 4.10.9.49affected
  • x to ≤ *unaffected

References