CVE-2024-0391 Details

A vulnerability exists in the email OTP flow of WSO2 Identity Server (versions 7.0.0, 6.1.0, 6.0.0, 5.11.0, and 5.10.0), WSO2 Identity Server as Key Manager 5.10.0, and WSO2 Open Banking IAM 2.0.0. The issue arises because the feature that checks user account lock states does not properly validate user input. This flaw allows attackers to infer the existence of registered user accounts, potentially leading to brute-force and social engineering attacks. Knowledge of valid usernames can be exploited to create targeted phishing campaigns or other malicious activities aimed at tricking users into revealing sensitive information, which could harm the organization's reputation and result in regulatory non-compliance and financial repercussions.

Users of WSO2 Identity Server can update to version 7.0.0 (update level 131), 6.1.0 (update level 254), 6.0.0 (update level 253), 5.11.0 (update levels 426 or 431) or 5.10.0 (update level 379). WSO2 Identity Server as Key Manager users can update to version 5.10.0 (update level 267). WSO2 Open Banking IAM users can update to version 2.0.0 (update level 318). Community users can apply the public fix available on GitHub.