CVE-2024-2323: CWE-307: Improper Restriction of Operations within the Bounds of a Null-Bounded Resource in WSO2 WSO2 Enterprise Integrator

The RemoteUserStoreManagerService component in WSO2 Enterprise Integrator does not adequately enforce restrictions on password change attempts when the password history validation feature is active. This improper restriction (CWE-307) allows an attacker to perform repeated password guessing attempts against user accounts without being effectively limited. Successful exploitation can lead to password disclosure through brute force, resulting in account impersonation. The attack success rate correlates with the complexity of the targeted user's password.

An attacker can perform repeated password guesses against user accounts without sufficient restriction, potentially discovering user passwords via brute force. This leads to account impersonation. The impact is limited to confidentiality and integrity with no availability impact. The risk is higher for accounts with simple passwords.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, organizations should consider enforcing strong password policies and monitoring for unusual password change attempts. No official fix or patch links are currently provided.