CVE-2024-28232mediumCWE-204

CVE-2024-28232: falha de média gravidade em IceWhaleTech CasaOS-UserService

Username Enumeration in CasaOS via bypass of CVE-2024-24766

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar CasaOS-UserService+ Monitorar github.com/IceWhaleTech/CasaOS-UserService

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.2epss 0.6%
Go package IceWhaleTech/CasaOS-UserService provides user management functionalities to CasaOS. The Casa OS Login page has disclosed the username enumeration vulnerability in the login page which was patched in version 0.4.7. This issue in CVE-2024-28232 has been patched in version 0.4.8 but that version has not yet been uploaded to Go's package manager.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
IceWhaleTech · CasaOS-UserService
CVEs relacionadas — IceWhaleTech CasaOS-UserService

No mesmo produto, das mais perigosas para as menos.

CVE-2024-24767CRITICALCasaOS Improper Restriction of Excessive Authentication Attempts vulnerabilityEPSS 1.0%CVE-2024-24765HIGHCasaOS-UserService allows unauthorized access to any fileEPSS 1.0%CVE-2024-24766MEDIUMCasaOS Username EnumerationEPSS 0.8%