CVE-2024-6832

Summary

The account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not maintain a consistent state for account locking if it cannot reach all configured user stores, allowing an attacker to repeatedly attempt authentication with invalid credentials without triggering the lockout mechanism for users within active stores.

When the account locking mechanism is bypassed due to the inaccessibility of secondary user stores, users in accessible user stores are left vulnerable to brute force attacks. A malicious actor can exploit this by attempting numerous invalid password combinations against a user account without the expected account lockout consequence.

Affected Software

VendorProductVersion RangeStatus
WSO2WSO2 Enterprise Integrator0 < 6.6.0unknown
WSO2WSO2 Enterprise Integrator6.6.0 < 6.6.0.229affected
WSO2WSO2 API Control Plane0 < 4.5.0unknown
WSO2WSO2 API Control Plane4.5.0 < 4.5.0.40affected
WSO2WSO2 API Control Plane4.6.0 < 4.6.0.4affected
WSO2WSO2 API Control Plane4.6.0 < 4.6.0.5affected
WSO2WSO2 Traffic Manager0 < 4.5.0unknown
WSO2WSO2 Traffic Manager4.5.0 < 4.5.0.38affected
WSO2WSO2 Traffic Manager4.6.0 < 4.6.0.4affected
WSO2WSO2 Traffic Manager4.6.0 < 4.6.0.5affected
WSO2WSO2 Universal Gateway0 < 4.5.0unknown
WSO2WSO2 Universal Gateway4.5.0 < 4.5.0.38affected
WSO2WSO2 Universal Gateway4.6.0 < 4.6.0.4affected
WSO2WSO2 Universal Gateway4.6.0 < 4.6.0.5affected
WSO2WSO2 API Manager0 < 3.1.0unknown
WSO2WSO2 API Manager3.1.0 < 3.1.0.296affected
WSO2WSO2 API Manager3.2.0 < 3.2.0.386affected
WSO2WSO2 API Manager3.2.0 < 3.2.0.455affected
WSO2WSO2 API Manager3.2.1 < 3.2.1.74affected
WSO2WSO2 API Manager4.1.0 < 4.1.0.238affected
WSO2WSO2 API Manager4.2.0 < 4.2.0.179affected
WSO2WSO2 API Manager4.3.0 < 4.3.0.91affected
WSO2WSO2 API Manager4.4.0 < 4.4.0.55affected
WSO2WSO2 API Manager4.5.0 < 4.5.0.39affected
WSO2WSO2 API Manager4.6.0 < 4.6.0.4affected
WSO2WSO2 Identity Server0 < 5.10.0unknown
WSO2WSO2 Identity Server5.10.0 < 5.10.0.320affected
WSO2WSO2 Identity Server5.11.0 < 5.11.0.427affected
WSO2WSO2 Identity Server6.0.0 < 6.0.0.254affected
WSO2WSO2 Identity Server6.1.0 < 6.1.0.195affected
WSO2WSO2 Identity Server7.0.0 < 7.0.0.82affected
WSO2WSO2 Identity Server as Key Manager0 < 5.10.0unknown
WSO2WSO2 Identity Server as Key Manager5.10.0 < 5.10.0.314affected
WSO2WSO2 Open Banking IAM0 < 2.0.0unknown
WSO2WSO2 Open Banking IAM2.0.0 < 2.0.0.366affected
WSO2WSO2 Open Banking AM0 < 2.0.0unknown
WSO2WSO2 Open Banking AM2.0.0 < 2.0.0.345affected
WSO2WSO2 Carbon User Manager Kernel4.5.0 < 4.5.0.7affected
WSO2WSO2 Carbon User Manager Kernel4.5.3 < 4.5.3.53affected
WSO2WSO2 Carbon User Manager Kernel4.6.0 < 4.6.0.196affected
WSO2WSO2 Carbon User Manager Kernel4.6.1 < 4.6.1.163affected
WSO2WSO2 Carbon User Manager Kernel4.6.1 < 4.6.1.164affected
WSO2WSO2 Carbon User Manager Kernel4.6.3 < 4.6.3.44affected
WSO2WSO2 Carbon User Manager Kernel4.6.4 < 4.6.4.25affected
WSO2WSO2 Carbon User Manager Kernel4.7.1 < 4.7.1.77affected
WSO2WSO2 Carbon User Manager Kernel4.7.1 < 4.7.1.78affected
WSO2WSO2 Carbon User Manager Kernel4.8.1 < 4.8.1.46affected
WSO2WSO2 Carbon User Manager Kernel4.9.26 < 4.9.26.33affected
WSO2WSO2 Carbon User Manager Kernel4.9.27 < 4.9.27.19affected
WSO2WSO2 Carbon User Manager Kernel4.9.28 < 4.9.28.21affected
WSO2WSO2 Carbon User Manager Kernel4.9.33 < 4.9.33.4affected
WSO2WSO2 Carbon User Manager Kernel4.10.9 < 4.10.9.49affected
WSO2WSO2 Carbon User Manager Kernelx <= *unaffected

Weaknesses

  • CWE-693: CWE-693: Protection Mechanism Failure

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References