CVE-2024-7478 Username Enumeration via External User Stores in Multiple WSO2 Products Allows User Account Discovery

When a WSO2 product is configured to use an external user store, the system fails to adequately obscure the existence or validity of usernames during authentication attempts. This oversight allows an attacker to repeatedly query the authentication mechanism with different username guesses, enabli...

CVE-2024-7478

Multiple WSO2 products are vulnerable to username enumeration when configured to use an external user store . The system fails to sufficiently obscure the existence or validity of usernames during authentication attempts, allowing an attacker to query the mechanism repeatedly to discover valid ac...