Vulnerability · Published Apr 1, 2024 · Assigned by GitHub_M
CVE-2024-28232Username Enumeration in CasaOS via bypass of CVE-2024-24766
Medium 6.2
In plain English
A medium-severity security flaw in CasaOS-UserService from IceWhaleTech. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Go package IceWhaleTech/CasaOS-UserService provides user management functionalities to CasaOS. The Casa OS Login page has disclosed the username enumeration vulnerability in the login page which was patched in version 0.4.7. This issue in CVE-2024-28232 has been patched in version 0.4.8 but that version has not yet been uploaded to Go's package manager.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/IceWhaleTech/CasaOS-UserService | 0.4.8 | GHSA-hcw2-2r9c-gc6p |
| Go | github.com/IceWhaleTech/CasaOS-UserService | 0.4.8 | GO-2024-2668 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| IceWhaleTech | CasaOS-UserService | = 0.4.7 |
Weakness: CWE-204 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N