CVE-2024-6832

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description The account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not maintain a consistent state for account locking if it cannot reach all configured user stores, which allows an attacker to repeatedly attempt authentication with invalid credentials without triggering the lockout mechanism for users within active stores. This bypass leaves users in accessible user stores vulnerable to brute force attacks, where a malicious actor can attempt numerous invalid password combinations without the expected account lockout consequence.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.