CVE-2024-2323: WSO2 Enterprise Integrator 6.6.0 to before 6.6.0.204; +6 more affected products

Affected technology

WSO2 Enterprise Integrator · 6.6.0 to before 6.6.0.204
WSO2

WSO2 Identity Server · 5.10.0 to before 5.10.0.286, 5.11.0 to before 5.11.0.344, 6.0.0 to before 6.0.0.188, 6.1.0 to before 6.1.0.150, 7.0.0 to before 7.0.0.35
WSO2

WSO2 API Manager · 3.1.0 to before 3.1.0.268, 3.2.0 to before 3.2.0.354
WSO2

WSO2 Open Banking AM · 2.0.0 to before 2.0.0.315
WSO2

WSO2 Identity Server as Key Manager · 5.10.0 to before 5.10.0.283
WSO2

WSO2 Open Banking IAM · 2.0.0 to before 2.0.0.335
WSO2

WSO2 Carbon User Manager Kernel · 4.5.0 to before 4.5.0.4, 4.5.3 to before 4.5.3.34, 4.6.0 to before 4.6.0.137, 4.6.1 to before 4.6.1.111, 4.7.1 to before 4.7.1.51, 4.9.0 to before 4.9.0.54, 4.10.9 to before 4.10.9.20
WSO2

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An attacker can repeatedly attempt password guesses for a user account without being adequately restricted. Source advisory’s CVSS 3.1 assessment (base score 4.8/10) rates confidentiality and integrity impact as low; availability impact as none.