CVE-2024-6832

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-6832
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-6832.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-6832
Published
2026-08-06T08:16:27.533Z
Modified
2026-08-11T03:45:25.514337254Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

The account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not maintain a consistent state for account locking if it cannot reach all configured user stores, allowing an attacker to repeatedly attempt authentication with invalid credentials without triggering the lockout mechanism for users within active stores.

When the account locking mechanism is bypassed due to the inaccessibility of secondary user stores, users in accessible user stores are left vulnerable to brute force attacks. A malicious actor can exploit this by attempting numerous invalid password combinations against a user account without the expected account lockout consequence.

Database specific 
{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "4.5.0"
                },
                {
                    "last_affected": "4.5.0"
                },
                {
                    "introduced": "4.6.0"
                },
                {
                    "last_affected": "4.6.0"
                }
            ],
            "source": "CPE_STRING",
            "cpes": [
                "cpe:2.3:a:wso2:api_control_plane:4.5.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:wso2:api_control_plane:4.6.0:*:*:*:*:*:*:*"
            ],
            "vendor_product": "wso2:api_control_plane"
        },
        {
            "extracted_events": [
                {
                    "introduced": "3.2.1"
                },
                {
                    "last_affected": "3.2.1"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "wso2:api_manager",
            "cpes": [
                "cpe:2.3:a:wso2:api_manager:3.2.1:*:*:*:*:*:*:*"
            ]
        },
        {
            "extracted_events": [
                {
                    "introduced": "5.10.0"
                },
                {
                    "last_affected": "5.10.0"
                },
                {
                    "introduced": "5.11.0"
                },
                {
                    "last_affected": "5.11.0"
                },
                {
                    "introduced": "6.0.0"
                },
                {
                    "last_affected": "6.0.0"
                },
                {
                    "introduced": "6.1.0"
                },
                {
                    "last_affected": "6.1.0"
                },
                {
                    "introduced": "7.0.0"
                },
                {
                    "last_affected": "7.0.0"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "wso2:identity_server",
            "cpes": [
                "cpe:2.3:a:wso2:identity_server:5.10.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:wso2:identity_server:5.11.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:wso2:identity_server:6.0.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:wso2:identity_server:6.1.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:wso2:identity_server:7.0.0:*:*:*:*:*:*:*"
            ]
        },
        {
            "extracted_events": [
                {
                    "introduced": "5.10.0"
                },
                {
                    "last_affected": "5.10.0"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "wso2:identity_server_as_key_manager",
            "cpes": [
                "cpe:2.3:a:wso2:identity_server_as_key_manager:5.10.0:*:*:*:*:*:*:*"
            ]
        },
        {
            "extracted_events": [
                {
                    "introduced": "2.0.0"
                },
                {
                    "last_affected": "2.0.0"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "wso2:open_banking_am",
            "cpes": [
                "cpe:2.3:a:wso2:open_banking_am:2.0.0:*:*:*:*:*:*:*"
            ]
        },
        {
            "extracted_events": [
                {
                    "introduced": "2.0.0"
                },
                {
                    "last_affected": "2.0.0"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "wso2:open_banking_iam",
            "cpes": [
                "cpe:2.3:a:wso2:open_banking_iam:2.0.0:*:*:*:*:*:*:*"
            ]
        },
        {
            "extracted_events": [
                {
                    "introduced": "4.5.0"
                },
                {
                    "last_affected": "4.5.0"
                },
                {
                    "introduced": "4.6.0"
                },
                {
                    "last_affected": "4.6.0"
                }
            ],
            "source": "CPE_STRING",
            "cpes": [
                "cpe:2.3:a:wso2:traffic_manager:4.5.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:wso2:traffic_manager:4.6.0:*:*:*:*:*:*:*"
            ],
            "vendor_product": "wso2:traffic_manager"
        },
        {
            "extracted_events": [
                {
                    "introduced": "4.5.0"
                },
                {
                    "last_affected": "4.5.0"
                },
                {
                    "introduced": "4.6.0"
                },
                {
                    "last_affected": "4.6.0"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "wso2:universal_gateway",
            "cpes": [
                "cpe:2.3:a:wso2:universal_gateway:4.5.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:wso2:universal_gateway:4.6.0:*:*:*:*:*:*:*"
            ]
        }
    ]
}
References

Affected packages

Git / github.com/wso2/product-apim

Affected ranges

Type
GIT
Repo
https://github.com/wso2/product-apim
Events
Introduced
2971de274564b622974de831403e9688a4a76c14
Last affected
8cc6ee54401aa3e3281cd7aeded278c9b7ed6988
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "3.1.0"
        },
        {
            "last_affected": "3.1.0"
        },
        {
            "introduced": "3.2.0"
        },
        {
            "last_affected": "3.2.0"
        },
        {
            "introduced": "4.1.0"
        },
        {
            "last_affected": "4.1.0"
        },
        {
            "introduced": "4.2.0"
        },
        {
            "last_affected": "4.2.0"
        },
        {
            "introduced": "4.3.0"
        },
        {
            "last_affected": "4.3.0"
        },
        {
            "introduced": "4.4.0"
        },
        {
            "last_affected": "4.4.0"
        },
        {
            "introduced": "4.5.0"
        },
        {
            "last_affected": "4.5.0"
        },
        {
            "introduced": "4.6.0"
        },
        {
            "last_affected": "4.6.0"
        }
    ],
    "source": "CPE_STRING",
    "cpe": [
        "cpe:2.3:a:wso2:api_manager:3.1.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:wso2:api_manager:3.2.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:wso2:api_manager:4.1.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:wso2:api_manager:4.2.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:wso2:api_manager:4.3.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:wso2:api_manager:4.4.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:wso2:api_manager:4.5.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:wso2:api_manager:4.6.0:*:*:*:*:*:*:*"
    ]
}

Affected versions

3.*
3.1.0
3.2.0
4.*
4.0.0-beta
4.1.0
4.2.0
4.3.0
4.4.0
4.5.0
4.6.0
v3.*
v3.1.0
v3.1.0-rc3
v3.2.0
v3.2.0-alpha
v3.2.0-beta
v3.2.0-m1
v3.2.0-rc1
v3.2.0-rc2
v3.2.0-rc3
v3.2.0-rc4
v3.2.0-rc5
v3.2.0-rc6
v4.*
v4.0.0
v4.0.0-alpha
v4.0.0-beta
v4.0.0-m1
v4.0.0-m2
v4.0.0-m3
v4.0.0-m4
v4.0.0-m5
v4.0.0-m6
v4.0.0-m7
v4.0.0-m8
v4.0.0-rc
v4.1.0
v4.1.0-alpha
v4.1.0-beta
v4.1.0-m1
v4.1.0-m2
v4.1.0-m3
v4.1.0-m4
v4.1.0-rc
v4.1.0-rc2
v4.1.0-rc3
v4.2.0
v4.2.0-alpha
v4.2.0-beta
v4.2.0-m1
v4.2.0-rc
v4.2.0-rc2
v4.3.0
v4.3.0-alpha
v4.3.0-alpha2
v4.3.0-beta
v4.3.0-m2
v4.3.0-rc
v4.3.0-rc2
v4.4.0
v4.4.0-alpha
v4.4.0-beta
v4.4.0-m1
v4.4.0-rc
v4.4.0-rc2
v4.5.0
v4.5.0-acp
v4.5.0-acp-alpha
v4.5.0-acp-beta
v4.5.0-acp-m1
v4.5.0-acp-rc
v4.5.0-acp-rc2
v4.5.0-beta
v4.5.0-gw
v4.5.0-gw-alpha
v4.5.0-gw-beta
v4.5.0-gw-m1
v4.5.0-gw-rc
v4.5.0-gw-rc2
v4.5.0-m1
v4.5.0-m2
v4.5.0-rc
v4.5.0-rc2
v4.5.0-tm
v4.5.0-tm-alpha
v4.5.0-tm-beta
v4.5.0-tm-m1
v4.5.0-tm-rc
v4.5.0-tm-rc2
v4.6.0
v4.6.0-acp-alpha
v4.6.0-acp-alpha2
v4.6.0-acp-alpha3
v4.6.0-acp-beta
v4.6.0-acp-m1
v4.6.0-acp-rc
v4.6.0-acp-rc2
v4.6.0-acp-rc3
v4.6.0-alpha
v4.6.0-alpha2
v4.6.0-alpha3
v4.6.0-beta
v4.6.0-gw-alpha
v4.6.0-gw-alpha2
v4.6.0-gw-alpha3
v4.6.0-gw-beta
v4.6.0-gw-m1
v4.6.0-gw-rc
v4.6.0-gw-rc2
v4.6.0-gw-rc3
v4.6.0-m1
v4.6.0-rc
v4.6.0-rc2
v4.6.0-rc3
v4.6.0-rc4
v4.6.0-tm
v4.6.0-tm-alpha
v4.6.0-tm-alpha2
v4.6.0-tm-alpha3
v4.6.0-tm-beta
v4.6.0-tm-m1
v4.6.0-tm-rc
v4.6.0-tm-rc2
v4.6.0-tm-rc3
v4.6.0-tm-rc4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-6832.json"