4 results · Clear filters · Feed
-
Medium 4.8
Account Lock Bypass via User Store Synchronization in Multiple WSO2 Products Allows Brute Force Attacks
The account lock feature fails to correctly enforce account lockouts on the primary user store when users with identical usernames exist in both primary and secondary user stores. This occurs because the lock condition is only applied to the secondary user st…
-
Medium 4.8
Password Brute Force via Password History Validation in Multiple WSO2 Products Allows User Account Discovery
The RemoteUserStoreManagerService does not sufficiently validate password change attempts when the password history validation feature is enabled. This oversight allows an attacker to repeatedly attempt password guesses for a user account without being adequa…
-
Medium 5.9
Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks
The account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not maintain a consistent state for account locking if it cannot reach all configured user stores, allowing an attacker to repeatedly attempt authent…
-
Medium 4.3
Incorrect Authorization in Multiple WSO2 Products Allows Unauthorized Access to Registry Versioned Files
An incorrect authorization vulnerability exists in multiple WSO2 products that allows unauthorized access to versioned files stored in the registry. Due to flawed authorization logic, a malicious actor with access to the management console can exploit a speci…