Account Lock Bypass via User Store Synchronization in Multiple WSO2 Products Allows Brute Force Attacks
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 4.0.0.298, 4.2.0.95, 4.3.0.13, 5.11.0.348, 6.0.0.194, and 14 more
- Who is exposed
- Not reported
Do first: Upgrade to a fixed version: 4.0.0.298, 4.2.0.95, 4.3.0.13, 5.11.0.348, 6.0.0.194, or one of 14 more.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- Published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 22/100 · provisional
- Fix
- Fixed in 4.0.0.298, 4.2.0.95, 4.3.0.13, 5.11.0.348, 6.0.0.194, and 14 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
This vulnerability affects multiple WSO2 products that use account lock features with user stores. It allows an attacker to bypass account lockouts on primary user store accounts when identically named accounts exist in a secondary user store, enabling repeated password guessing that could lead to unauthorized access.
Read the original description
The account lock feature fails to correctly enforce account lockouts on the primary user store when users with identical usernames exist in both primary and secondary user stores. This occurs because the lock condition is only applied to the secondary user store account in such scenarios, allowing continued authentication attempts against the primary user store account. This functional flaw enables brute force attacks. By systematically attempting different passwords against the primary user store account, an attacker can potentially gain unauthorized access to sensitive information or accounts, as the intended account lockout mechanism does not prevent repeated login attempts.
What to do
Upgrade to a fixed version: 4.0.0.298, 4.2.0.95, 4.3.0.13, 5.11.0.348, 6.0.0.194, or one of 14 more.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- WSO2 WSO2 API Manager
From 4.0.0 · fixed in 4.0.0.298; From 4.2.0 · fixed in 4.2.0.95; From 4.3.0 · fixed in 4.3.0.13
- WSO2 WSO2 Identity Server
From 5.11.0 · fixed in 5.11.0.348; From 6.0.0 · fixed in 6.0.0.194; From 6.1.0 · fixed in 6.1.0.162; From 7.0.0 · fixed in 7.0.0.33
- org.wso2.carbon.identity.mgt
From 5.18.187 · fixed in 5.18.187.259; From 5.23.8 · fixed in 5.23.8.180; From 5.24.8 · fixed in 5.24.8.5; From 5.25.92 · fixed in 5.25.92.84; From 5.25.705 · fixed in 5.25.705.5; From 7.0.78 · fixed in 7.0.78.19
- org.wso2.carbon:org.wso2.carbon.user.core
From 4.6.1 · fixed in 4.6.1.114; From 4.7.1 · fixed in 4.7.1.53; From 4.8.1 · fixed in 4.8.1.16; From 4.9.0 · fixed in 4.9.0.58; From 4.9.26 · fixed in 4.9.26.7; From 4.10.9 · fixed in 4.10.9.17
Evidence 1
- Advisory
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.