CVE-2024-0391 Username Enumeration via Email OTP Flow in Multiple WSO2 Products Allows User Account Discovery

[
  {
    "vendor": "WSO2",
    "product": "WSO2 Identity Server",
    "versions": [
      {
        "status": "unknown",
        "version": "0",
        "lessThan": "5.10.0",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.10.0",
        "lessThan": "5.10.0.379",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.11.0",
        "lessThan": "5.11.0.426",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.11.0",
        "lessThan": "5.11.0.431",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "6.0.0",
        "lessThan": "6.0.0.253",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "6.1.0",
        "lessThan": "6.1.0.254",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "7.0.0",
        "lessThan": "7.0.0.131",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "WSO2",
    "product": "WSO2 Open Banking IAM",
    "versions": [
      {
        "status": "unknown",
        "version": "0",
        "lessThan": "2.0.0",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "2.0.0",
        "lessThan": "2.0.0.318",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "WSO2",
    "product": "WSO2 Identity Server as Key Manager",
    "versions": [
      {
        "status": "unknown",
        "version": "0",
        "lessThan": "5.10.0",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.10.0",
        "lessThan": "5.10.0.267",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "WSO2",
    "product": "Email OTP Authenticator",
    "packageName": "org.wso2.carbon.identity.local.auth.emailotp:org.wso2.carbon.identity.local.auth.emailotp",
    "versions": [
      {
        "status": "affected",
        "version": "1.0.18",
        "lessThan": "1.0.18.7",
        "versionType": "custom"
      },
      {
        "status": "unaffected",
        "version": "1.0.24",
        "lessThanOrEqual": "*",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "vendor": "WSO2",
    "product": "WSO2 Carbon Authenticator Library For EmailOTP",
    "packageName": "org.wso2.carbon.extension.identity.authenticator.outbound.emailotp:org.wso2.carbon.identity.authenticator.emailotp",
    "versions": [
      {
        "status": "affected",
        "version": "4.1.0",
        "lessThan": "4.1.0.8",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "4.1.4",
        "lessThan": "4.1.4.9",
        "versionType": "custom"
      },
      {
        "status": "unaffected",
        "version": "4.1.22",
        "lessThanOrEqual": "*",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "vendor": "WSO2",
    "product": "WSO2 Carbon Authenticator Library For EmailOTP",
    "packageName": "org.wso2.carbon.extension.identity.authenticator.outbound.emailotp:org.wso2.carbon.extension.identity.authenticator.emailotp.connector",
    "versions": [
      {
        "status": "affected",
        "version": "3.0.5",
        "lessThan": "3.0.5.8",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "3.0.24",
        "lessThan": "3.0.24.6",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "3.0.26",
        "lessThan": "3.0.26.16",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]