{"id":"CVE-2024-2323","url":"https://www.cyber-defence.io/tools/cve/CVE-2024-2323","generatedAt":"2026-10-28T03:58:52.639Z","title":"The RemoteUserStoreManagerService does not sufficiently validate password change attempts when the password history validation feature is enabled.","description":"The RemoteUserStoreManagerService does not sufficiently validate password change attempts when the password history validation feature is enabled. This oversight allows an attacker to repeatedly attempt password guesses for a user account without being adequately restricted.\n\nExploiting this vulnerability enables an attacker to discover a user's password through brute force, leading to account impersonation. The success rate of such an attack is influenced by the complexity of the targeted user's password, with simpler passwords increasing the likelihood of compromise.","published":"2026-10-20T08:16:41.000Z","lastModified":"2026-10-20T20:17:09.000Z","status":"Awaiting Analysis","sourceIdentifier":"ed10eef1-636d-4fbe-9993-6890dfa878f8","cvss":{"version":"3.1","score":4.8,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"},"cwe":["CWE-307"],"affected":[],"epss":{"score":0.00229,"percentile":0.13625,"date":"2026-10-27","history":[{"date":"2026-10-20","score":0.00168,"percentile":0.05781}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.23%). Track it; it rarely justifies an emergency change on its own."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-20T08:16:41.000Z","detail":{"score":"4.8","severity":"MEDIUM","publishedAt":"2026-10-20T08:16:40.983Z"},"summary":"New CVE, medium severity (CVSS 4.8)."}],"references":[{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3217/","source":"ed10eef1-636d-4fbe-9993-6890dfa878f8"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2024-2323","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}