Approved changes feed: RSS · Atom
cpe:2.3:a:icewhaletech:casaos:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Icewhaletech (20802497-dbe3-5521-a21d-b7e0e3316d72) |
|---|---|
| Product | Casaos (ff5f6738-efec-59b2-9bcc-9bcae5ab871e) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2023-37469 |
vulnerable | 2026-06-08 06:08:15.395791 |
CasaOS Command Injection vulnerability
HIGH (8.8)
CasaOS is an open-source personal cloud system. Prior to version 0.4.4, if an authenticated user using CasaOS is able to successfully connect to a controlled SMB server, they are able to execute arbitrary commands. Version 0.4.4 contains a patch for the issue.
Published: 2023-08-24T22:12:10.234Z
Updated: 2024-10-02T18:26:44.156Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-37266 |
vulnerable | 2026-06-08 06:08:15.032879 |
Weak json web token (JWT) secrets in CasaOS
CRITICAL (9.8)
CasaOS is an open-source Personal Cloud system. Unauthenticated attackers can craft arbitrary JWTs and access features that usually require authentication and execute arbitrary commands as `root` on CasaOS instances. This problem was addressed by improving the validation of JWTs in commit `705bf1f`. This patch is part of CasaOS 0.4.4. Users should upgrade to CasaOS 0.4.4. If they can't, they should temporarily restrict access to CasaOS to untrusted users, for instance by not exposing it publicly.
Published: 2023-07-17T20:57:43.078Z
Updated: 2024-12-12T20:51:16.121Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.