Strix
74.2K

CVE-2024-9517

MEDIUMCVSS 4.9/10

Last modified

CVE-2024-9517 is a medium-severity vulnerability rated 4.9/10 on the CVSS scale. The refresh token grant type in WSO2 products fails to re-validate account status before issuing new access tokens. This weakness allows an attacker to obtain valid access tokens for user accounts even after they have been blocked by the user store, bypassing account lockout mechanisms. This vulnerability can lead to unauthorized access to user accounts and their associated resources.

Description

The refresh token grant type in WSO2 products fails to re-validate account status before issuing new access tokens. This weakness allows an attacker to obtain valid access tokens for user accounts even after they have been blocked by the user store, bypassing account lockout mechanisms. This vulnerability can lead to unauthorized access to user accounts and their associated resources. Attackers can leverage this to perform actions on behalf of blocked users, potentially leading to privilege escalation or data exfiltration depending on the permissions of the compromised account.

Metrics

CVSS 3.1
4.9/10

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness Enumeration

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
WSO2WSO2 API Manager< 3.1.0; >= 3.1.0, < 3.1.0.308; >= 3.2.0, < 3.2.0.429; >= 3.2.1, < 3.2.1.49; >= 4.0.0, < 4.0.0.315; >= 4.1.0, < 4.1.0.214; >= 4.2.0, < 4.2.0.149; >= 4.3.0, < 4.3.0.62; >= 4.4.0, < 4.4.0.25; >= 4.5.0, < 4.5.0.9
WSO2WSO2 Universal Gateway>= 4.5.0, < 4.5.0.9
WSO2WSO2 Traffic Manager>= 4.5.0, < 4.5.0.9
WSO2WSO2 API Control Plane>= 4.5.0, < 4.5.0.10
WSO2WSO2 Identity Server as Key Manager< 5.10.0; >= 5.10.0, < 5.10.0.324
WSO2WSO2 Identity Server< 5.10.0; >= 5.10.0, < 5.10.0.331; >= 5.11.0, < 5.11.0.376; >= 6.0.0, < 6.0.0.219; >= 6.1.0, < 6.1.0.205; >= 7.0.0, < 7.0.0.73
WSO2WSO2 Open Banking AM< 2.0.0; >= 2.0.0, < 2.0.0.357
WSO2WSO2 Open Banking IAM< 2.0.0; >= 2.0.0, < 2.0.0.377
WSO2WSO2 Carbon OAuth>= 6.4.2, < 6.4.2.148; >= 6.4.111, < 6.4.111.122; >= 6.4.176, < 6.4.176.26; >= 6.4.180, < 6.4.180.10; >= 6.8.0, < 6.8.0.44; >= 6.9.6, < 6.9.6.21; >= 6.11.21, < 6.11.21.64; >= 6.13.16, < 6.13.16.13; >= 6.13.19, < 6.13.19.7; >= 6.13.27, < 6.13.27.1; >= 7.0.26, < 7.0.26.37

References

Timeline

Published
Last Modified
Status
Awaiting Analysis

Frequently Asked Questions

What is CVE-2024-9517?
The refresh token grant type in WSO2 products fails to re-validate account status before issuing new access tokens. This weakness allows an attacker to obtain valid access tokens for user accounts even after they have been blocked by the user store, bypassing account lockout mechanisms. This vulnerability can lead to unauthorized access to user accounts and their associated resources. Attackers can leverage this to perform actions on behalf of blocked users, potentially leading to privilege escalation or data exfiltration depending on the permissions of the compromised account.
How severe is CVE-2024-9517?
CVE-2024-9517 has a CVSS score of 4.9/10 (MEDIUM severity).
How do I fix CVE-2024-9517?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2024

View all 2024CVEs →

Are you affected by CVE-2024-9517?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST