CVE-2024-24767criticalCWE-307

CVE-2024-24767: fallo crítico en IceWhaleTech CasaOS-UserService

CasaOS Improper Restriction of Excessive Authentication Attempts vulnerability

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear CasaOS-UserService+ Monitorear github.com/IceWhaleTech/CasaOS-UserService

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.1epss 1.0%
CasaOS-UserService provides user management functionalities to CasaOS. Starting in version 0.4.4.3 and prior to version 0.4.7, CasaOS doesn't defend against password brute force attacks, which leads to having full access to the server. The web application lacks control over the login attempts. This vulnerability allows attackers to get super user-level access over the server. Version 0.4.7 contains a patch for this issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Productos afectados
IceWhaleTech · CasaOS-UserService
CVEs relacionadas — IceWhaleTech CasaOS-UserService

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-24765HIGHCasaOS-UserService allows unauthorized access to any fileEPSS 1.0%CVE-2024-24766MEDIUMCasaOS Username EnumerationEPSS 0.8%CVE-2024-28232MEDIUMUsername Enumeration in CasaOS via bypass of CVE-2024-24766EPSS 0.6%