Incomplete reCaptcha Implementation in Authentication Flows in WSO2 Identity Server Allows Brute Force Attacks (WSO2 WSO2 Identity Server)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.19 % · percentile 9 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- WSO2
- NVD status
- Deferred
Description
Due to an incomplete implementation, reCaptcha is not applied to certain authentication flows even when the reCaptcha option is enabled. This oversight permits attackers to bypass the intended protection mechanism. Brute force attacks, if successful, can lead to unauthorized access to user accounts and sensitive information by systematically attempting various credential combinations.
Weaknesses (CWE)
- CWE-306 — Missing Authentication for Critical Functionality
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 4.8 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N | WSO2 |
| CVSS 3.1 | MEDIUM 4.8 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N | NVD · ed10eef1-636d-4fbe-9993-6890dfa878f8 (Secondary) |
European references
- ENISA EUVD · EUVD-2024-55812
- GCVE · GCVE-0-2024-5563
Affected products
| Product | Versions |
|---|---|
| WSO2 · WSO2 Identity Server | unknown 0 < 7.0.0 ; affected 7.0.0 < 7.0.0.37 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |