WSO2 API Manager Authentication information disclosure

Summaryinfo

A vulnerability has been found in WSO2 API Manager, Carbon Identity Handler, Identity Server, Open Banking AM and Open Banking IAM and classified as problematic. Affected is an unknown function of the component Authentication. This manipulation causes information disclosure. The identification of this vulnerability is CVE-2024-7478. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability classified as problematic was found in WSO2 API Manager, Carbon Identity Handler, Identity Server, Open Banking AM and Open Banking IAM. Affected by this vulnerability is an unknown part of the component Authentication. The manipulation with an unknown input leads to a information disclosure vulnerability. The CWE definition for the vulnerability is CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. As an impact it is known to affect confidentiality. The summary by CVE is:

When a WSO2 product is configured to use an external user store, the system fails to adequately obscure the existence or validity of usernames during authentication attempts. This oversight allows an attacker to repeatedly query the authentication mechanism with different username guesses, enabling the enumeration of valid usernames present in the external user store. The discovery of valid usernames can increase the risk of targeted brute-force attacks, social engineering, and information leakage. Attackers can leverage this information to craft more convincing phishing campaigns or other social engineering tactics to trick users into revealing sensitive data. The presence of username enumeration could also negatively impact an organization's reputation, leading to loss of customer trust, regulatory non-compliance, and potential legal and financial repercussions.

It is possible to read the advisory at security.docs.wso2.com. This vulnerability is known as CVE-2024-7478 since 08/05/2024. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/21/2026). The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Banking Software

Vendor

• WSO2

Name

• API Manager
• Carbon Identity Handler
• Identity Server
• Open Banking AM
• Open Banking IAM

License

• commercial

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion