CVE-2024-5617
Full vulnerability record from the local CVENow database.
Description
The account lock feature fails to correctly enforce account lockouts on the primary user store when users with identical usernames exist in both primary and secondary user stores. This occurs because the lock condition is only applied to the secondary user store account in such scenarios, allowing continued authentication attempts against the primary user store account. This functional flaw enables brute force attacks. By systematically attempting different passwords against the primary user store account, an attacker can potentially gain unauthorized access to sensitive information or accounts, as the intended account lockout mechanism does not prevent repeated login attempts.
Severity
MEDIUM
CVSS score
4.8
(v3.1)
Vulnerability status
Received
Source identifier
ed10eef1-636d-4fbe-9993-6890dfa878f8
Published
2026-11-02 06:17:41.933000
Last modified
2026-11-02 06:17:41.933000
View original CVE JSON
{
"id": "CVE-2024-5617",
"sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"published": "2026-11-02T06:17:41.933",
"lastModified": "2026-11-02T06:17:41.933",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The account lock feature fails to correctly enforce account lockouts on the primary user store when users with identical usernames exist in both primary and secondary user stores. This occurs because the lock condition is only applied to the secondary user store account in such scenarios, allowing continued authentication attempts against the primary user store account.\n\nThis functional flaw enables brute force attacks. By systematically attempting different passwords against the primary user store account, an attacker can potentially gain unauthorized access to sensitive information or accounts, as the intended account lockout mechanism does not prevent repeated login attempts."
}
],
"affected": [
{
"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"affectedData": [
{
"vendor": "WSO2",
"product": "WSO2 API Manager",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThan": "4.0.0",
"versionType": "custom",
"status": "unknown"
},
{
"version": "4.0.0",
"lessThan": "4.0.0.298",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.2.0",
"lessThan": "4.2.0.95",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.3.0",
"lessThan": "4.3.0.13",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "WSO2",
"product": "WSO2 Identity Server",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThan": "5.11.0",
"versionType": "custom",
"status": "unknown"
},
{
"version": "5.11.0",
"lessThan": "5.11.0.348",
"versionType": "custom",
"status": "affected"
},
{
"version": "6.0.0",
"lessThan": "6.0.0.194",
"versionType": "custom",
"status": "affected"
},
{
"version": "6.1.0",
"lessThan": "6.1.0.162",
"versionType": "custom",
"status": "affected"
},
{
"version": "7.0.0",
"lessThan": "7.0.0.33",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "WSO2",
"product": "WSO2 Carbon Identity Management",
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.identity.mgt",
"versions": [
{
"version": "5.18.187",
"lessThan": "5.18.187.259",
"versionType": "custom",
"status": "affected"
},
{
"version": "5.23.8",
"lessThan": "5.23.8.180",
"versionType": "custom",
"status": "affected"
},
{
"version": "5.24.8",
"lessThan": "5.24.8.5",
"versionType": "custom",
"status": "affected"
},
{
"version": "5.25.92",
"lessThan": "5.25.92.84",
"versionType": "custom",
"status": "affected"
},
{
"version": "5.25.705",
"lessThan": "5.25.705.5",
"versionType": "custom",
"status": "affected"
},
{
"version": "7.0.78",
"lessThan": "7.0.78.19",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "WSO2",
"product": "WSO2 Carbon User Manager Kernel",
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon:org.wso2.carbon.user.core",
"versions": [
{
"version": "4.6.1",
"lessThan": "4.6.1.114",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.7.1",
"lessThan": "4.7.1.53",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.8.1",
"lessThan": "4.8.1.16",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.9.0",
"lessThan": "4.9.0.58",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.9.26",
"lessThan": "4.9.26.7",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.10.9",
"lessThan": "4.10.9.17",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.2,
"impactScore": 2.5
}
]
},
"weaknesses": [
{
"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-799"
}
]
}
],
"references": [
{
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3414/",
"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"
}
]
}