CVE-2024-24765highCWE-200

CVE-2024-24765: fallo de gravedad alta en IceWhaleTech CasaOS-UserService

CasaOS-UserService allows unauthorized access to any file

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear CasaOS-UserService+ Monitorear github.com/IceWhaleTech/CasaOS-UserService

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.5epss 1.0%
CasaOS-UserService provides user management functionalities to CasaOS. Prior to version 0.4.7, path filtering of the URL for user avatar image files was not strict, making it possible to get any file on the system. This could allow an unauthorized actor to access, for example, the CasaOS user database, and possibly obtain system root privileges. Version 0.4.7 fixes this issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Productos afectados
IceWhaleTech · CasaOS-UserService
CVEs relacionadas — IceWhaleTech CasaOS-UserService

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-24767CRITICALCasaOS Improper Restriction of Excessive Authentication Attempts vulnerabilityEPSS 1.0%CVE-2024-24766MEDIUMCasaOS Username EnumerationEPSS 0.8%CVE-2024-28232MEDIUMUsername Enumeration in CasaOS via bypass of CVE-2024-24766EPSS 0.6%