{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-5617", "assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "state": "PUBLISHED", "assignerShortName": "WSO2", "dateReserved": "2024-06-04T06:07:32.224Z", "datePublished": "2026-11-02T05:57:28.711Z", "dateUpdated": "2026-11-02T19:40:18.967Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "shortName": "WSO2", "dateUpdated": "2026-11-02T06:13:53.229Z"}, "title": "Account Lock Bypass via User Store Synchronization in Multiple WSO2 Products Allows Brute Force Attacks", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-799", "description": "CWE-799: Improper Neutralization of Input During Action Execution ('Code Injection')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-210", "descriptions": [{"lang": "en", "value": "CAPEC-210 CAPEC-210: Brute Force Attack"}]}], "affected": [{"vendor": "WSO2", "product": "WSO2 API Manager", "versions": [{"status": "unknown", "version": "0", "lessThan": "4.0.0", "versionType": "custom"}, {"status": "affected", "version": "4.0.0", "lessThan": "4.0.0.298", "versionType": "custom"}, {"status": "affected", "version": "4.2.0", "lessThan": "4.2.0.95", "versionType": "custom"}, {"status": "affected", "version": "4.3.0", "lessThan": "4.3.0.13", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Identity Server", "versions": [{"status": "unknown", "version": "0", "lessThan": "5.11.0", "versionType": "custom"}, {"status": "affected", "version": "5.11.0", "lessThan": "5.11.0.348", "versionType": "custom"}, {"status": "affected", "version": "6.0.0", "lessThan": "6.0.0.194", "versionType": "custom"}, {"status": "affected", "version": "6.1.0", "lessThan": "6.1.0.162", "versionType": "custom"}, {"status": "affected", "version": "7.0.0", "lessThan": "7.0.0.33", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Carbon Identity Management", "packageName": "org.wso2.carbon.identity.mgt", "versions": [{"status": "affected", "version": "5.18.187", "lessThan": "5.18.187.259", "versionType": "custom"}, {"status": "affected", "version": "5.23.8", "lessThan": "5.23.8.180", "versionType": "custom"}, {"status": "affected", "version": "5.24.8", "lessThan": "5.24.8.5", "versionType": "custom"}, {"status": "affected", "version": "5.25.92", "lessThan": "5.25.92.84", "versionType": "custom"}, {"status": "affected", "version": "5.25.705", "lessThan": "5.25.705.5", "versionType": "custom"}, {"status": "affected", "version": "7.0.78", "lessThan": "7.0.78.19", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "WSO2", "product": "WSO2 Carbon User Manager Kernel", "packageName": "org.wso2.carbon:org.wso2.carbon.user.core", "versions": [{"status": "affected", "version": "4.6.1", "lessThan": "4.6.1.114", "versionType": "custom"}, {"status": "affected", "version": "4.7.1", "lessThan": "4.7.1.53", "versionType": "custom"}, {"status": "affected", "version": "4.8.1", "lessThan": "4.8.1.16", "versionType": "custom"}, {"status": "affected", "version": "4.9.0", "lessThan": "4.9.0.58", "versionType": "custom"}, {"status": "affected", "version": "4.9.26", "lessThan": "4.9.26.7", "versionType": "custom"}, {"status": "affected", "version": "4.10.9", "lessThan": "4.10.9.17", "versionType": "custom"}], "defaultStatus": "unknown"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0.0", "versionEndExcluding": "4.0.0.298"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2.0", "versionEndExcluding": "4.2.0.95"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.3.0", "versionEndExcluding": "4.3.0.13"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11.0", "versionEndExcluding": "5.11.0.348"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0.0", "versionEndExcluding": "6.0.0.194"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.0", "versionEndExcluding": "6.1.0.162"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0.0", "versionEndExcluding": "7.0.0.33"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_management:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18.187", "versionEndExcluding": "5.18.187.259"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_management:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.23.8", "versionEndExcluding": "5.23.8.180"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_management:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.24.8", "versionEndExcluding": "5.24.8.5"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_management:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.25.92", "versionEndExcluding": "5.25.92.84"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_management:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.25.705", "versionEndExcluding": "5.25.705.5"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_management:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0.78", "versionEndExcluding": "7.0.78.19"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_user_manager_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6.1", "versionEndExcluding": "4.6.1.114"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_user_manager_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7.1", "versionEndExcluding": "4.7.1.53"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_user_manager_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8.1", "versionEndExcluding": "4.8.1.16"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_user_manager_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9.0", "versionEndExcluding": "4.9.0.58"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_user_manager_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9.26", "versionEndExcluding": "4.9.26.7"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_user_manager_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10.9", "versionEndExcluding": "4.10.9.17"}]}]}], "descriptions": [{"lang": "en", "value": "The account lock feature fails to correctly enforce account lockouts on the primary user store when users with identical usernames exist in both primary and secondary user stores. This occurs because the lock condition is only applied to the secondary user store account in such scenarios, allowing continued authentication attempts against the primary user store account.\n\nThis functional flaw enables brute force attacks. By systematically attempting different passwords against the primary user store account, an attacker can potentially gain unauthorized access to sensitive information or accounts, as the intended account lockout mechanism does not prevent repeated login attempts.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "The account lock feature fails to correctly enforce account lockouts on the primary user store when users with identical usernames exist in both primary and secondary user stores. This occurs because the lock condition is only applied to the secondary user store account in such scenarios, allowing continued authentication attempts against the primary user store account.\n\nThis functional flaw enables brute force attacks. By systematically attempting different passwords against the primary user store account, an attacker can potentially gain unauthorized access to sensitive information or accounts, as the intended account lockout mechanism does not prevent repeated login attempts."}]}], "references": [{"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3414/", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 4.8, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}}], "solutions": [{"lang": "en", "value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3414/#solution https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3414/#solution", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<span style=\"background-color: transparent;\">Follow the instructions given on </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3414/#solution\"><span style=\"background-color: transparent;\">https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3414/#solution</span></a> <br>"}]}], "source": {"advisory": "WSO2-2024-3414", "discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-02T19:39:59.036625Z", "id": "CVE-2024-5617", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T19:40:18.967Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-5617", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-02T19:39:59.036625Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T19:40:11.144Z"}}], "cna": {"title": "Account Lock Bypass via User Store Synchronization in Multiple WSO2 Products Allows Brute Force Attacks", "source": {"advisory": "WSO2-2024-3414", "discovery": "INTERNAL"}, "impacts": [{"capecId": "CAPEC-210", "descriptions": [{"lang": "en", "value": "CAPEC-210 CAPEC-210: Brute Force Attack"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "WSO2", "product": "WSO2 API Manager", "versions": [{"status": "unknown", "version": "0", "lessThan": "4.0.0", "versionType": "custom"}, {"status": "affected", "version": "4.0.0", "lessThan": "4.0.0.298", "versionType": "custom"}, {"status": "affected", "version": "4.2.0", "lessThan": "4.2.0.95", "versionType": "custom"}, {"status": "affected", "version": "4.3.0", "lessThan": "4.3.0.13", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Identity Server", "versions": [{"status": "unknown", "version": "0", "lessThan": "5.11.0", "versionType": "custom"}, {"status": "affected", "version": "5.11.0", "lessThan": "5.11.0.348", "versionType": "custom"}, {"status": "affected", "version": "6.0.0", "lessThan": "6.0.0.194", "versionType": "custom"}, {"status": "affected", "version": "6.1.0", "lessThan": "6.1.0.162", "versionType": "custom"}, {"status": "affected", "version": "7.0.0", "lessThan": "7.0.0.33", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Carbon Identity Management", "versions": [{"status": "affected", "version": "5.18.187", "lessThan": "5.18.187.259", "versionType": "custom"}, {"status": "affected", "version": "5.23.8", "lessThan": "5.23.8.180", "versionType": "custom"}, {"status": "affected", "version": "5.24.8", "lessThan": "5.24.8.5", "versionType": "custom"}, {"status": "affected", "version": "5.25.92", "lessThan": "5.25.92.84", "versionType": "custom"}, {"status": "affected", "version": "5.25.705", "lessThan": "5.25.705.5", "versionType": "custom"}, {"status": "affected", "version": "7.0.78", "lessThan": "7.0.78.19", "versionType": "custom"}], "packageName": "org.wso2.carbon.identity.mgt", "defaultStatus": "unknown"}, {"vendor": "WSO2", "product": "WSO2 Carbon User Manager Kernel", "versions": [{"status": "affected", "version": "4.6.1", "lessThan": "4.6.1.114", "versionType": "custom"}, {"status": "affected", "version": "4.7.1", "lessThan": "4.7.1.53", "versionType": "custom"}, {"status": "affected", "version": "4.8.1", "lessThan": "4.8.1.16", "versionType": "custom"}, {"status": "affected", "version": "4.9.0", "lessThan": "4.9.0.58", "versionType": "custom"}, {"status": "affected", "version": "4.9.26", "lessThan": "4.9.26.7", "versionType": "custom"}, {"status": "affected", "version": "4.10.9", "lessThan": "4.10.9.17", "versionType": "custom"}], "packageName": "org.wso2.carbon:org.wso2.carbon.user.core", "defaultStatus": "unknown"}], "solutions": [{"lang": "en", "value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3414/#solution https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3414/#solution", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: transparent;\">Follow the instructions given on </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3414/#solution\"><span style=\"background-color: transparent;\">https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3414/#solution</span></a> <br>", "base64": false}]}], "references": [{"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3414/", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "The account lock feature fails to correctly enforce account lockouts on the primary user store when users with identical usernames exist in both primary and secondary user stores. This occurs because the lock condition is only applied to the secondary user store account in such scenarios, allowing continued authentication attempts against the primary user store account.\n\nThis functional flaw enables brute force attacks. By systematically attempting different passwords against the primary user store account, an attacker can potentially gain unauthorized access to sensitive information or accounts, as the intended account lockout mechanism does not prevent repeated login attempts.", "supportingMedia": [{"type": "text/html", "value": "The account lock feature fails to correctly enforce account lockouts on the primary user store when users with identical usernames exist in both primary and secondary user stores. This occurs because the lock condition is only applied to the secondary user store account in such scenarios, allowing continued authentication attempts against the primary user store account.\n\nThis functional flaw enables brute force attacks. By systematically attempting different passwords against the primary user store account, an attacker can potentially gain unauthorized access to sensitive information or accounts, as the intended account lockout mechanism does not prevent repeated login attempts.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-799", "description": "CWE-799: Improper Neutralization of Input During Action Execution ('Code Injection')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.0.0.298", "versionStartIncluding": "4.0.0"}, {"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.2.0.95", "versionStartIncluding": "4.2.0"}, {"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.3.0.13", "versionStartIncluding": "4.3.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.11.0.348", "versionStartIncluding": "5.11.0"}, {"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.0.0.194", "versionStartIncluding": "6.0.0"}, {"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.0.162", "versionStartIncluding": "6.1.0"}, {"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0.0.33", "versionStartIncluding": "7.0.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_management:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.18.187.259", "versionStartIncluding": "5.18.187"}, {"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_management:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.23.8.180", "versionStartIncluding": "5.23.8"}, {"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_management:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.24.8.5", "versionStartIncluding": "5.24.8"}, {"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_management:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.25.92.84", "versionStartIncluding": "5.25.92"}, {"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_management:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.25.705.5", "versionStartIncluding": "5.25.705"}, {"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_management:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0.78.19", "versionStartIncluding": "7.0.78"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wso2:wso2_carbon_user_manager_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.6.1.114", "versionStartIncluding": "4.6.1"}, {"criteria": "cpe:2.3:a:wso2:wso2_carbon_user_manager_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.7.1.53", "versionStartIncluding": "4.7.1"}, {"criteria": "cpe:2.3:a:wso2:wso2_carbon_user_manager_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.8.1.16", "versionStartIncluding": "4.8.1"}, {"criteria": "cpe:2.3:a:wso2:wso2_carbon_user_manager_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.9.0.58", "versionStartIncluding": "4.9.0"}, {"criteria": "cpe:2.3:a:wso2:wso2_carbon_user_manager_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.9.26.7", "versionStartIncluding": "4.9.26"}, {"criteria": "cpe:2.3:a:wso2:wso2_carbon_user_manager_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.10.9.17", "versionStartIncluding": "4.10.9"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "shortName": "WSO2", "dateUpdated": "2026-11-02T06:13:53.229Z"}}}, "cveMetadata": {"cveId": "CVE-2024-5617", "state": "PUBLISHED", "dateUpdated": "2026-11-02T19:40:18.967Z", "dateReserved": "2024-06-04T06:07:32.224Z", "assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "datePublished": "2026-11-02T05:57:28.711Z", "assignerShortName": "WSO2"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WSO2 API Manager", "vendor": "WSO2", "versions": [{"lessThan": "4.0.0", "status": "unknown", "version": "0", "versionType": "custom"}, {"lessThan": "4.0.0.298", "status": "affected", "version": "4.0.0", "versionType": "custom"}, {"lessThan": "4.2.0.95", "status": "affected", "version": "4.2.0", "versionType": "custom"}, {"lessThan": "4.3.0.13", "status": "affected", "version": "4.3.0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "WSO2 Identity Server", "vendor": "WSO2", "versions": [{"lessThan": "5.11.0", "status": "unknown", "version": "0", "versionType": "custom"}, {"lessThan": "5.11.0.348", "status": "affected", "version": "5.11.0", "versionType": "custom"}, {"lessThan": "6.0.0.194", "status": "affected", "version": "6.0.0", "versionType": "custom"}, {"lessThan": "6.1.0.162", "status": "affected", "version": "6.1.0", "versionType": "custom"}, {"lessThan": "7.0.0.33", "status": "affected", "version": "7.0.0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "packageName": "org.wso2.carbon.identity.mgt", "product": "WSO2 Carbon Identity Management", "vendor": "WSO2", "versions": [{"lessThan": "5.18.187.259", "status": "affected", "version": "5.18.187", "versionType": "custom"}, {"lessThan": "5.23.8.180", "status": "affected", "version": "5.23.8", "versionType": "custom"}, {"lessThan": "5.24.8.5", "status": "affected", "version": "5.24.8", "versionType": "custom"}, {"lessThan": "5.25.92.84", "status": "affected", "version": "5.25.92", "versionType": "custom"}, {"lessThan": "5.25.705.5", "status": "affected", "version": "5.25.705", "versionType": "custom"}, {"lessThan": "7.0.78.19", "status": "affected", "version": "7.0.78", "versionType": "custom"}]}, {"defaultStatus": "unknown", "packageName": "org.wso2.carbon:org.wso2.carbon.user.core", "product": "WSO2 Carbon User Manager Kernel", "vendor": "WSO2", "versions": [{"lessThan": "4.6.1.114", "status": "affected", "version": "4.6.1", "versionType": "custom"}, {"lessThan": "4.7.1.53", "status": "affected", "version": "4.7.1", "versionType": "custom"}, {"lessThan": "4.8.1.16", "status": "affected", "version": "4.8.1", "versionType": "custom"}, {"lessThan": "4.9.0.58", "status": "affected", "version": "4.9.0", "versionType": "custom"}, {"lessThan": "4.9.26.7", "status": "affected", "version": "4.9.26", "versionType": "custom"}, {"lessThan": "4.10.9.17", "status": "affected", "version": "4.10.9", "versionType": "custom"}]}], "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The account lock feature fails to correctly enforce account lockouts on the primary user store when users with identical usernames exist in both primary and secondary user stores. This occurs because the lock condition is only applied to the secondary user store account in such scenarios, allowing continued authentication attempts against the primary user store account.\n\nThis functional flaw enables brute force attacks. By systematically attempting different passwords against the primary user store account, an attacker can potentially gain unauthorized access to sensitive information or accounts, as the intended account lockout mechanism does not prevent repeated login attempts."}], "id": "CVE-2024-5617", "lastModified": "2026-11-02T20:17:21.830", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 2.5, "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-5617", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-02T19:39:59.036625Z", "version": "2.0.3"}}]}, "published": "2026-11-02T06:17:41.933", "references": [{"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3414/"}], "sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-799"}], "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "type": "Secondary"}]}

{}