CVE-2024-7478: WSO2 API Manager 3.1.0 to before 3.1.0.310, 3.2.0 to before 3.2.0.401, 3.2.1 to before 3.2.1.26, 4.0.0 to before…

Affected technology

WSO2 API Manager · 3.1.0 to before 3.1.0.310, 3.2.0 to before 3.2.0.401, 3.2.1 to before 3.2.1.26, 4.0.0 to before 4.0.0.318, 4.1.0 to before 4.1.0.180, 4.2.0 to before 4.2.0.119, 4.3.0 to before 4.3.0.30
WSO2

WSO2 Identity Server as Key Manager · 5.10.0 to before 5.10.0.320
WSO2

WSO2 Identity Server · 5.10.0 to before 5.10.0.326, 6.0.0 to before 6.0.0.214, 6.1.0 to before 6.1.0.198, 7.0.0 to before 7.0.0.67
WSO2

WSO2 Open Banking IAM · 2.0.0 to before 2.0.0.371
WSO2

WSO2 Open Banking AM · 2.0.0 to before 2.0.0.351
WSO2

WSO2 Carborn Identity Handler · 1.4.0 to before 1.4.0.15, 1.4.0 to before 1.4.0.16, 1.4.11 to before 1.4.11.14, 1.4.37 to before 1.4.37.1, 1.6.1 to before 1.6.1.5, 1.7.1 to before 1.7.1.1, 1.8.6 to before 1.8.6.5, 1.8.14 to before 1.8.14.1, 1.9.2 to before 1.9.2.4
WSO2

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An attacker can repeatedly query the authentication mechanism with different username guesses, enabling the enumeration of valid usernames present in the external user store. Source advisory’s CVSS 3.1 assessment (base score 5.8/10) rates confidentiality impact as low; integrity and availability impact as none.