CVE-2024-48932
Medium
Description
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In versions below 1.5.0, the API endpoint `http://<Server-ip>/v1/users/name` allows unauthenticated users to access sensitive information, such as usernames, without any authorization. This vulnerability could be exploited by an attacker to enumerate usernames and leverage them for further attacks, such as brute-force or phishing campaigns. As of time of publication, no known patched versions are available.
SeverityMedium
CVSS5.3
Exploit probability—
ProductZimaspace Zimaos
PublishedOct 24, 2024
First seenOct 24, 2024
Weakness typeCWE-284Improper access control
How to fix
Update
- zimaspace zimaos1.2.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zimaspace zimaos | v < 1.2.5 | 1.2.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.