CVE-2024-2323
Received Received - Intake

Password Brute Force in WSO2 Identity Server

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: WSO2 LLC

Description
The RemoteUserStoreManagerService does not sufficiently validate password change attempts when the password history validation feature is enabled. This oversight allows an attacker to repeatedly attempt password guesses for a user account without being adequately restricted. Exploiting this vulnerability enables an attacker to discover a user's password through brute force, leading to account impersonation. The success rate of such an attack is influenced by the complexity of the targeted user's password, with simpler passwords increasing the likelihood of compromise.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2024-2323
EUVD
EUVD-2024-55809

Affected Vendors & Products

Showing 18 associated CPEs
Vendor Product Version / Range
WSO2 WSO2 Enterprise Integrator 6.6.0
WSO2 WSO2 Identity Server 5.10.0
WSO2 WSO2 Identity Server 5.11.0
WSO2 WSO2 Identity Server 6.0.0
WSO2 WSO2 Identity Server 6.1.0
WSO2 WSO2 Identity Server 7.0.0
WSO2 WSO2 API Manager 3.1.0
WSO2 WSO2 API Manager 3.2.0
WSO2 WSO2 Open Banking AM 2.0.0
WSO2 WSO2 Identity Server as Key Manager 5.10.0
WSO2 WSO2 Open Banking IAM 2.0.0
WSO2 WSO2 Carbon User Manager Kernel 4.5.0
WSO2 WSO2 Carbon User Manager Kernel 4.5.3
WSO2 WSO2 Carbon User Manager Kernel 4.6.0
WSO2 WSO2 Carbon User Manager Kernel 4.6.1
WSO2 WSO2 Carbon User Manager Kernel 4.7.1
WSO2 WSO2 Carbon User Manager Kernel 4.9.0
WSO2 WSO2 Carbon User Manager Kernel 4.10.9

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-307 The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in the RemoteUserStoreManagerService when password history validation is enabled. It fails to properly restrict repeated password change attempts, allowing attackers to brute force user passwords. The attack exploits weak password complexity to gain unauthorized account access.

Impact Analysis

An attacker could impersonate your account by guessing your password through repeated attempts. The impact depends on your password strength; simpler passwords are more easily compromised. This could lead to unauthorized access to sensitive data or system functions.

Mitigation Strategies

Disable password history validation feature in RemoteUserStoreManagerService to prevent brute force attacks. Ensure strong password policies are enforced for all user accounts to reduce success rate of password guessing attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2024-2323. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart