{"id":"CVE-2024-7478","kind":"vulnerability","aliases":["CVE-2024-7478"],"related":[],"title":"WSO2 products: external user store leaks which usernames exist","description":"When a WSO2 product is configured to use an external user store, the system fails to adequately obscure the existence or validity of usernames during authentication attempts. This oversight allows an attacker to repeatedly query the authentication mechanism with different username guesses, enabling the enumeration of valid usernames present in the external user store.\n\nThe discovery of valid usernames can increase the risk of targeted brute-force attacks, social engineering, and information leakage. Attackers can leverage this information to craft more convincing phishing campaigns or other social engineering tactics to trick users into revealing sensitive data. The presence of username enumeration could also negatively impact an organization's reputation, leading to loss of customer trust, regulatory non-compliance, and potential legal and financial repercussions.","summary":"When a WSO2 product uses an external user store, its login flow does not hide whether a username exists or is valid. An attacker can repeat login attempts with guessed names and map out valid accounts for later brute-force or phishing.","severity":"medium","cvss":5.8,"epss":0.00235,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["identity","self-hosted","vendor","wso2"],"not_affected_if":["built-in-user-store-only"],"how_to_check":"- Confirm whether a WSO2 product is configured with an external user store (LDAP or JDBC user store outside the built-in one), using the product's user-store settings; unknown if the sources do not say which config keys apply.\n- Check the product version against the fixed release listed in the NVD entry; unknown if the sources do not give the affected version range.","fix":"- Upgrade the affected WSO2 product to the fixed release named in the vendor advisory; unknown if the sources do not give the version.\n- Until patched, limit login attempts and watch for many failed logins with different usernames; unknown if the sources give a specific setting.","status":"open","published_at":"2026-10-21T14:17:06+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T04:10:07+00:00","updated_at":"2026-10-25T04:10:07+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T04:10:07Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the affected WSO2 product to the fixed release named in the vendor advisory; unknown if the sources do not give the version.\n- Until patched, limit login attempts and watch for many failed logins with different usernames; unknown if the sources give a specific setting.","reach":"network","title":"WSO2 products: external user store leaks which usernames exist","impact":"low","summary":"When a WSO2 product uses an external user store, its login flow does not hide whether a username exists or is valid. An attacker can repeat login attempts with guessed names and map out valid accounts for later brute-force or phishing.","category":"vendor","nicknames":[],"who_cares":["wso2","self-hosted","identity"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker learns which usernames exist, enabling targeted guessing.","analyst_note":"","how_to_check":"- Confirm whether a WSO2 product is configured with an external user store (LDAP or JDBC user store outside the built-in one), using the product's user-store settings; unknown if the sources do not say which config keys apply.\n- Check the product version against the fixed release listed in the NVD entry; unknown if the sources do not give the affected version range.","needs_analyst":false,"not_affected_if":["built-in-user-store-only"],"who_is_affected":"Teams running a WSO2 identity or API product that authenticates users against an external user store such as LDAP or a database. Deployments that use only the built-in user store, or that do not expose the login endpoint to untrusted networks, are less exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000632,"input_tokens":3496,"output_tokens":564,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2024':11A,14A '-7478':12A,15A 'account':57B 'adequ':81C 'allow':94C 'also':168C 'attack':45B,96C,133C,139C 'attempt':49B,91C 'authent':90C,101C 'brute':61B,131C 'brute-forc':60B,130C 'campaign':149C 'complianc':184C 'configur':70C 'convinc':147C 'could':167C 'craft':145C 'custom':179C 'cve':10A,13A 'data':161C 'differ':104C 'discoveri':120C 'enabl':107C 'engin':135C,153C 'enumer':109C,166C 'exist':9A,40B,84C 'extern':3A,28B,74C,116C 'fail':79C 'financi':189C 'flow':33B 'forc':62B,132C 'guess':51B,106C 'hide':36B 'host':19B 'ident':16B 'impact':170C 'increas':125C 'inform':137C,143C 'later':59B 'lead':175C 'leak':6A 'leakag':138C 'legal':187C 'leverag':141C 'login':32B,48B 'loss':177C 'map':54B 'mechan':102C 'name':52B 'negat':169C 'non':183C 'non-compli':182C 'obscur':82C 'organ':172C 'oversight':93C 'phish':64B,148C 'potenti':186C 'presenc':163C 'present':113C 'product':2A,25B,68C 'queri':99C 'regulatori':181C 'repeat':47B,98C 'repercuss':190C 'reput':174C 'reveal':159C 'risk':127C 'self':18B 'self-host':17B 'sensit':160C 'social':134C,152C 'store':5A,30B,76C,118C 'system':78C 'tactic':154C 'target':129C 'trick':156C 'trust':180C 'use':26B,72C 'user':4A,29B,75C,117C,157C 'usernam':8A,39B,88C,105C,112C,123C,165C 'valid':43B,56B,86C,111C,122C 'vendor':20B 'whether':37B 'wso2':1A,21B,24B,67C","nicknames":[],"mitigations":[],"who_affected":"Teams running a WSO2 identity or API product that authenticates users against an external user store such as LDAP or a database. Deployments that use only the built-in user store, or that do not expose the login endpoint to untrusted networks, are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T14:17:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","cvss_by":"ed10eef1-636d-4fbe-9993-6890dfa878f8","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2024-7478","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-7478","severity":null,"published_at":"2026-10-21T14:17:06+00:00","modified_at":"2026-10-21T18:37:59+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2024-7478","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-7478","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}