WSO2 API Manager Password History Validation Feature excessive authentication

Summaryinfo

A vulnerability was found in WSO2 API Manager, Carbon User Manager Kernel, Enterprise Integrator, Identity Server, Identity Server as Key Manager, Open Banking AM and Open Banking IAM and classified as problematic. The affected element is an unknown function of the component Password History Validation Feature. Executing a manipulation can lead to excessive authentication. This vulnerability is tracked as CVE-2024-2323. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability was found in WSO2 API Manager, Carbon User Manager Kernel, Enterprise Integrator, Identity Server, Identity Server as Key Manager, Open Banking AM and Open Banking IAM. It has been declared as problematic. This vulnerability affects an unknown code of the component Password History Validation Feature. The manipulation with an unknown input leads to a excessive authentication vulnerability. The CWE definition for the vulnerability is CWE-307. The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks. As an impact it is known to affect confidentiality. CVE summarizes:

The RemoteUserStoreManagerService does not sufficiently validate password change attempts when the password history validation feature is enabled. This oversight allows an attacker to repeatedly attempt password guesses for a user account without being adequately restricted. Exploiting this vulnerability enables an attacker to discover a user's password through brute force, leading to account impersonation. The success rate of such an attack is influenced by the complexity of the targeted user's password, with simpler passwords increasing the likelihood of compromise.

The advisory is shared for download at security.docs.wso2.com. This vulnerability was named CVE-2024-2323 since 03/08/2024. The exploitation appears to be difficult. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 10/20/2026). The MITRE ATT&CK project declares the attack technique as T1110.001.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Banking Software

Vendor

• WSO2

Name

• API Manager
• Carbon User Manager Kernel
• Enterprise Integrator
• Identity Server
• Identity Server as Key Manager
• Open Banking AM
• Open Banking IAM

License

• commercial

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion