CVE-2024-5563

{
  "id": "CVE-2024-5563",
  "sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
  "published": "2026-10-21T14:17:05.230",
  "lastModified": "2026-10-27T19:10:00.123",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Due to an incomplete implementation, reCaptcha is not applied to certain authentication flows even when the reCaptcha option is enabled. This oversight permits attackers to bypass the intended protection mechanism.\n\nBrute force attacks, if successful, can lead to unauthorized access to user accounts and sensitive information by systematically attempting various credential combinations."
    },
    {
      "lang": "es",
      "value": "Debido a una implementación incompleta, reCaptcha no se aplica a ciertos flujos de autenticación aunque la opción de reCaptcha esté habilitada. Esta omisión permite a los atacantes eludir el mecanismo de protección previsto.\\n\\nLos ataques de fuerza bruta, si tienen éxito, pueden provocar acceso no autorizado a cuentas de usuario e información sensible al intentar sistemáticamente diversas combinaciones de credenciales."
    }
  ],
  "affected": [
    {
      "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
      "affectedData": [
        {
          "vendor": "WSO2",
          "product": "WSO2 Identity Server",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "7.0.0",
              "versionType": "custom",
              "status": "unknown"
            },
            {
              "version": "7.0.0",
              "lessThan": "7.0.0.37",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "baseScore": 4.8,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 2.5
      }
    ]
  },
  "weaknesses": [
    {
      "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3436/",
      "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"
    }
  ]
}