Casaos Userservice
Approved changes feed: RSS · Atom
cpe:2.3:a:icewhaletech:casaos-userservice:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Icewhaletech (20802497-dbe3-5521-a21d-b7e0e3316d72) |
|---|---|
| Product | Casaos Userservice (7211e00b-ba3f-55a7-a7b0-bb1d5c6c2595) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-28232 |
vulnerable | 2026-06-08 06:33:26.774180 |
Username Enumeration in CasaOS via bypass of CVE-2024-24766
MEDIUM (6.2)
Go package IceWhaleTech/CasaOS-UserService provides user management functionalities to CasaOS. The Casa OS Login page has disclosed the username enumeration vulnerability in the login page which was patched in version 0.4.7. This issue in CVE-2024-28232 has been patched in version 0.4.8 but that version has not yet been uploaded to Go's package manager.
Published: 2024-04-01T16:42:05.726Z
Updated: 2024-08-02T00:48:49.710Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-24767 |
vulnerable | 2026-06-08 06:29:41.691808 |
CasaOS Improper Restriction of Excessive Authentication Attempts vulnerability
CRITICAL (9.1)
CasaOS-UserService provides user management functionalities to CasaOS. Starting in version 0.4.4.3 and prior to version 0.4.7, CasaOS doesn't defend against password brute force attacks, which leads to having full access to the server. The web application lacks control over the login attempts. This vulnerability allows attackers to get super user-level access over the server. Version 0.4.7 contains a patch for this issue.
Published: 2024-03-06T18:06:26.237Z
Updated: 2024-08-28T17:53:11.773Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-24766 |
vulnerable | 2026-06-08 06:29:41.690135 |
CasaOS Username Enumeration
MEDIUM (6.2)
CasaOS-UserService provides user management functionalities to CasaOS. Starting in version 0.4.4.3 and prior to version 0.4.7, the Casa OS Login page disclosed the username enumeration vulnerability in the login page. An attacker can enumerate the CasaOS username using the application response. If the username is incorrect application gives the error `**User does not exist**`. If the password is incorrect application gives the error `**Invalid password**`. Version 0.4.7 fixes this issue.
Published: 2024-03-06T18:10:25.869Z
Updated: 2024-08-01T23:28:11.932Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-24765 |
vulnerable | 2026-06-08 06:29:41.688510 |
CasaOS-UserService allows unauthorized access to any file
HIGH (7.5)
CasaOS-UserService provides user management functionalities to CasaOS. Prior to version 0.4.7, path filtering of the URL for user avatar image files was not strict, making it possible to get any file on the system. This could allow an unauthorized actor to access, for example, the CasaOS user database, and possibly obtain system root privileges. Version 0.4.7 fixes this issue.
Published: 2024-03-06T17:31:56.841Z
Updated: 2024-08-06T14:01:47.283Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-37469 |
vulnerable | 2026-06-08 06:08:15.395610 |
CasaOS Command Injection vulnerability
HIGH (8.8)
CasaOS is an open-source personal cloud system. Prior to version 0.4.4, if an authenticated user using CasaOS is able to successfully connect to a controlled SMB server, they are able to execute arbitrary commands. Version 0.4.4 contains a patch for the issue.
Published: 2023-08-24T22:12:10.234Z
Updated: 2024-10-02T18:26:44.156Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.