CVE-2024-0391mediumCWE-204

CVE-2024-0391: fallo de gravedad media en WSO2 Email OTP Authenticator

Username Enumeration via Email OTP Flow in Multiple WSO2 Products Allows User Account Discovery

Publicada el

Seguir esta CVE+ Monitorear WSO2 Identity Server+ Monitorear WSO2 Identity Server as Key Manager

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.3epss 0.2%
The check user account lock states feature within the email OTP flow fails to validate user input, allowing an attacker to infer the existence of registered user accounts. The discovery of valid usernames can increase the risk of brute-force and social engineering attacks. Attackers can leverage this information to craft targeted phishing campaigns or other malicious activities aimed at tricking users into divulging sensitive data, potentially damaging the organization's reputation and leading to regulatory non-compliance and financial consequences.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Productos afectados
WSO2 · Email OTP AuthenticatorWSO2 · WSO2 Carbon Authenticator Library For EmailOTPWSO2 · WSO2 Identity ServerWSO2 · WSO2 Identity Server as Key ManagerWSO2 · WSO2 Open Banking IAM
CVEs relacionadas — WSO2 Email OTP Authenticator

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-3125MEDIUMAuthenticated Arbitrary File Upload in Multiple WSO2 Products via CarbonAppUploader Admin Service Leading to Remote Code ExecutionEPSS 0.9%CVE-2025-5605MEDIUMAuthentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information DisclosureEPSS 0.9%CVE-2025-10611CRITICALPotential Broken Access Control in Multiple WSO2 Products via System REST APIsEPSS 0.8%CVE-2024-6914CRITICALIncorrect Authorization in Multiple WSO2 Products via Account Recovery SOAP Admin Service Leading to Account TakeoverEPSS 0.8%CVE-2024-7096MEDIUMPrivilege Escalation in Multiple WSO2 Products via SOAP Admin Service Due to Business Logic FlawEPSS 0.7%CVE-2025-15039CRITICALAccount Takeover via Conditional Authentication Script Logic in Multiple WSO2 ProductsEPSS 0.7%