CVE-2024-28232mediumCWE-204

CVE-2024-28232: fallo de gravedad media en IceWhaleTech CasaOS-UserService

Username Enumeration in CasaOS via bypass of CVE-2024-24766

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear CasaOS-UserService+ Monitorear github.com/IceWhaleTech/CasaOS-UserService

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.2epss 0.6%
Go package IceWhaleTech/CasaOS-UserService provides user management functionalities to CasaOS. The Casa OS Login page has disclosed the username enumeration vulnerability in the login page which was patched in version 0.4.7. This issue in CVE-2024-28232 has been patched in version 0.4.8 but that version has not yet been uploaded to Go's package manager.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Productos afectados
IceWhaleTech · CasaOS-UserService
CVEs relacionadas — IceWhaleTech CasaOS-UserService

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-24767CRITICALCasaOS Improper Restriction of Excessive Authentication Attempts vulnerabilityEPSS 1.0%CVE-2024-24765HIGHCasaOS-UserService allows unauthorized access to any fileEPSS 1.0%CVE-2024-24766MEDIUMCasaOS Username EnumerationEPSS 0.8%