CVE-2024-28232mediumCWE-204

CVE-2024-28232: medium-severity vulnerability in IceWhaleTech CasaOS-UserService

Username Enumeration in CasaOS via bypass of CVE-2024-24766

Published · Updated

Follow this CVE+ Monitor CasaOS-UserService+ Monitor github.com/IceWhaleTech/CasaOS-UserService

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.2epss 0.6%
Go package IceWhaleTech/CasaOS-UserService provides user management functionalities to CasaOS. The Casa OS Login page has disclosed the username enumeration vulnerability in the login page which was patched in version 0.4.7. This issue in CVE-2024-28232 has been patched in version 0.4.8 but that version has not yet been uploaded to Go's package manager.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
IceWhaleTech · CasaOS-UserService
Related CVEs — IceWhaleTech CasaOS-UserService

In the same product, most dangerous first.

CVE-2024-24767CRITICALCasaOS Improper Restriction of Excessive Authentication Attempts vulnerabilityEPSS 1.0%CVE-2024-24765HIGHCasaOS-UserService allows unauthorized access to any fileEPSS 1.0%CVE-2024-24766MEDIUMCasaOS Username EnumerationEPSS 0.8%