CasaOS-UserService vulnerabilities
5 known vulnerabilities in CasaOS-UserService from IceWhaleTech. 5 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.5 High severity
CasaOS-UserService: Observable Response Discrepancy
Go package IceWhaleTech/CasaOS-UserService provides user management functionalities to CasaOS. The Casa OS Login page has disclosed the username enumeration vulnerability in the login page which was patched in version 0.4.7. This issue in CVE-2024-28232 has be
- 7.5 High severity
CasaOS-UserService: Observable Discrepancy
CasaOS-UserService provides user management functionalities to CasaOS. Starting in version 0.4.4.3 and prior to version 0.4.7, the Casa OS Login page disclosed the username enumeration vulnerability in the login page. An attacker can enumerate the CasaOS usern
- 9.8 Critical severity
CasaOS-UserService: Improper Restriction of Excessive Authentication Attempts
CasaOS-UserService provides user management functionalities to CasaOS. Starting in version 0.4.4.3 and prior to version 0.4.7, CasaOS doesn't defend against password brute force attacks, which leads to having full access to the server. The web application lack
- 9.8 Critical severity
CasaOS-UserService: Exposure of Sensitive Information to an Unauthorized Actor
CasaOS-UserService provides user management functionalities to CasaOS. Prior to version 0.4.7, path filtering of the URL for user avatar image files was not strict, making it possible to get any file on the system. This could allow an unauthorized actor to acc
- 8.8 High severity
CasaOS: Improper Neutralization of Special Elements used in a Command
CasaOS is an open-source personal cloud system. Prior to version 0.4.4, if an authenticated user using CasaOS is able to successfully connect to a controlled SMB server, they are able to execute arbitrary commands. Version 0.4.4 contains a patch for the issue.