Password Management Flaw in WSO2's Remote User Store Manager Service

CVE-2024-2323

What is CVE-2024-2323?

The Remote User Store Manager Service in WSO2 lacks adequate validation for password changes, particularly when the password history feature is active. This deficiency allows attackers to make multiple unauthorized password attempts on user accounts without appropriate restrictions. Such exploits can lead to successful brute force attacks, especially against users with simpler passwords, resulting in unauthorized access and account impersonation. Mitigating this risk requires enhancing password change mechanisms and implementing stricter validation controls.

References