CVE-2024-24767criticalCWE-307

CVE-2024-24767: falha crítica em IceWhaleTech CasaOS-UserService

CasaOS Improper Restriction of Excessive Authentication Attempts vulnerability

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar CasaOS-UserService+ Monitorar github.com/IceWhaleTech/CasaOS-UserService

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.1epss 1.0%
CasaOS-UserService provides user management functionalities to CasaOS. Starting in version 0.4.4.3 and prior to version 0.4.7, CasaOS doesn't defend against password brute force attacks, which leads to having full access to the server. The web application lacks control over the login attempts. This vulnerability allows attackers to get super user-level access over the server. Version 0.4.7 contains a patch for this issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Produtos afetados
IceWhaleTech · CasaOS-UserService
CVEs relacionadas — IceWhaleTech CasaOS-UserService

No mesmo produto, das mais perigosas para as menos.

CVE-2024-24765HIGHCasaOS-UserService allows unauthorized access to any fileEPSS 1.0%CVE-2024-24766MEDIUMCasaOS Username EnumerationEPSS 0.8%CVE-2024-28232MEDIUMUsername Enumeration in CasaOS via bypass of CVE-2024-24766EPSS 0.6%