CVE-2024-24766
Medium
Description
CasaOS-UserService provides user management functionalities to CasaOS. Starting in version 0.4.4.3 and prior to version 0.4.7, the Casa OS Login page disclosed the username enumeration vulnerability in the login page. An attacker can enumerate the CasaOS username using the application response. If the username is incorrect application gives the error `**User does not exist**`. If the password is incorrect application gives the error `**Invalid password**`. Version 0.4.7 fixes this issue.
SeverityMedium
CVSS6.2
Exploit probability—
ProductIcewhale Casaos-userservice
PublishedMar 6, 2024
First seenMar 6, 2024
Weakness typeCWE-204CWE-204
How to fix
Update
- github.com/IceWhaleTech/CasaOS-UserService0.4.7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| icewhale casaos-userservice | 0.4.4-3 ≤ v ≤ 0.4.7 | — |
| github.com/IceWhaleTech/CasaOS-UserServiceGo | 0.4.4.3 ≤ v < 0.4.7, 0.4.4-3-alpha1 ≤ v < 0.4.7 | 0.4.7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.