Veille CVE

Recherche « WSO2 Carbon Identity User Store »

6 CVE

Critique 1 Élevée 2 Moyenne 2 Faible 1 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « WSO2 Carbon Identity User Store » ✕
  1. CVE-2024-2323 4.8 Moyenne

    WSO2 Enterprise Integrator · WSO2 Identity Server · WSO2 API Manager · WSO2 Open Banking AM

    The RemoteUserStoreManagerService does not sufficiently validate password change attempts when the password history validation feature is enabled. This oversight allows an attacker to repeatedly attempt password guesses for a user account without being adequately restricted. Exploiting this vulnerability enables an attacker to discover a user's password through brute force, leading to account impersonation. The success rate of such an attack is influenced by the complexity of the targeted user's password, with simpler passwords increasing the likelihood of compromise.

  2. CVE-2025-10149 8.2 Élevée

    WSO2 Identity Server as Key Manager · WSO2 Open Banking IAM · WSO2 Identity Server · WSO2 Carbon SCIM Common Component

    The SCIM endpoint does not sufficiently validate authorization for federated users when performing operations against the local user store. This occurs when a local and a federated user share the same username, allowing a federated user to perform actions intended for a local user, including arbitrary operations. A malicious actor authenticated as a federated user may perform arbitrary operations on local user accounts via the SCIM 2.0 or SCIM 1.1 endpoints when local and federated users share the same username. This could lead to user account takeover. Deployments that do not support user self-registration are considered medium severity.

  3. CVE-2024-4412 2.7 Faible

    WSO2 Enterprise Integrator · WSO2 API Manager · WSO2 Open Banking IAM · WSO2 Identity Server

    The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment. Exploitation of this vulnerability requires administrator privileges. The impact is minimal as EL usage is restricted to certain read operations.

  4. CVE-2024-4457 9.1 Critique

    WSO2 Enterprise Integrator · WSO2 API Manager · WSO2 Open Banking AM · WSO2 Open Banking IAM

    The Management Console fails to properly validate input related to the configuration of JDBC user stores. This weakness allows an attacker to supply specially crafted input that can lead to the execution of arbitrary code on the affected server. Successful exploitation of this vulnerability enables an attacker to execute arbitrary code on the server with the privileges of the WSO2 product. This could lead to a full compromise of the system.

  5. CVE-2025-13394 5.4 Moyenne

    WSO2 Identity Server · WSO2 API Manager · WSO2 Open Banking IAM · WSO2 Open Banking AM

    The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery (CSRF) attacks. Specifically, it utilizes the HTTP GET method for these operations, and while the SameSite=Lax cookie attribute is employed for mitigation, this mechanism is bypassed as it permits cookies to be sent with cross-origin top-level navigation requests, including GET requests. This allows an attacker to trick an authenticated user's browser into unknowingly executing unintended actions. An attacker can exploit this vulnerability to perform unauthorized state-altering requests on behalf of authenticated users. This could lead to consequences such as data modification, account changes, or other actions that could result in data compromise or loss of user control over their account. However, this attack is only feasible if the Carbon console and related services are exposed to the public internet, which is not recommended according to WSO2's security guidelines.

  6. CVE-2024-6832 7.5 Élevée

    WSO2 Enterprise Integrator · WSO2 API Control Plane · WSO2 Traffic Manager · WSO2 Universal Gateway

    The account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not maintain a consistent state for account locking if it cannot reach all configured user stores, allowing an attacker to repeatedly attempt authentication with invalid credentials without triggering the lockout mechanism for users within active stores. When the account locking mechanism is bypassed due to the inaccessibility of secondary user stores, users in accessible user stores are left vulnerable to brute force attacks. A malicious actor can exploit this by attempting numerous invalid password combinations against a user account without the expected account lockout consequence.