CVSS: 6.2EPSS: 0%CPEs: 1EXPL: 0CVE-2024-24766 – CasaOS Username Enumeration
https://notcve.org/view.php?id=CVE-2024-24766
CasaOS-UserService provides user management functionalities to CasaOS. Starting in version 0.4.4.3 and prior to version 0.4.7, the Casa OS Login page disclosed the username enumeration vulnerability in the login page. An attacker can enumerate the CasaOS username using the application response. If the username is incorrect application gives the error `**User does not exist**`. If the password is incorrect application gives the error `**Invalid password**`. • https://github.com/IceWhaleTech/CasaOS-UserService/commit/c75063d7ca5800948e9c09c0a6efe9809b5d39f7 https://github.com/IceWhaleTech/CasaOS-UserService/releases/tag/v0.4.7 https://github.com/IceWhaleTech/CasaOS-UserService/security/advisories/GHSA-c967-2652-gfjm • CWE-204: Observable Response Discrepancy •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-24767 – CasaOS Improper Restriction of Excessive Authentication Attempts vulnerability
https://notcve.org/view.php?id=CVE-2024-24767
CasaOS-UserService provides user management functionalities to CasaOS. Starting in version 0.4.4.3 and prior to version 0.4.7, CasaOS doesn't defend against password brute force attacks, which leads to having full access to the server. The web application lacks control over the login attempts. This vulnerability allows attackers to get super user-level access over the server. Version 0.4.7 contains a patch for this issue. • https://github.com/IceWhaleTech/CasaOS-UserService/commit/62006f61b55951048dbace4ebd9e483274838699 https://github.com/IceWhaleTech/CasaOS-UserService/releases/tag/v0.4.7 https://github.com/IceWhaleTech/CasaOS-UserService/security/advisories/GHSA-c69x-5xmw-v44x • CWE-307: Improper Restriction of Excessive Authentication Attempts •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-24765 – CasaOS-UserService allows unauthorized access to any file
https://notcve.org/view.php?id=CVE-2024-24765
CasaOS-UserService provides user management functionalities to CasaOS. Prior to version 0.4.7, path filtering of the URL for user avatar image files was not strict, making it possible to get any file on the system. This could allow an unauthorized actor to access, for example, the CasaOS user database, and possibly obtain system root privileges. Version 0.4.7 fixes this issue. CasaOS-UserService proporciona funcionalidades de gestión de usuarios a CasaOS. • https://github.com/IceWhaleTech/CasaOS-UserService/commit/3f4558e23c0a9958f9a0e20aabc64aa8fd51840e https://github.com/IceWhaleTech/CasaOS-UserService/releases/tag/v0.4.7 https://github.com/IceWhaleTech/CasaOS-UserService/security/advisories/GHSA-h5gf-cmm8-cg7c • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •