Username Enumeration Vulnerability in WSO2 Products

CVE-2024-7478

What is CVE-2024-7478?

An issue in WSO2 products occurs when configured to use an external user store, allowing attackers to deduce the existence or validity of usernames during authentication attempts. This flaw exposes the system to repeated queries that can reveal valid usernames, increasing vulnerability to brute-force attacks and social engineering tactics. Furthermore, the ability to identify valid usernames opens pathways for crafting convincing phishing campaigns, potentially resulting in sensitive data breaches. The implications also include reputational damage to the organization, loss of customer trust, regulatory non-compliance, and possible legal consequences.

References