CVE-2024-28232 MEDIUM

CVE-2024-28232: Username Enumeration in CasaOS via bypass of CVE-2024-24766

Vendor Icewhaletech
Product CasaOS-UserService
Weakness CWE-204
Published April 1, 2024
Last update August 2, 2024
View on NVD All CVEs

CVSS base score

6.2/10
Attack vector Local
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

Go package IceWhaleTech/CasaOS-UserService provides user management functionalities to CasaOS. The Casa OS Login page has disclosed the username enumeration vulnerability in the login page which was patched in version 0.4.7. This issue in CVE-2024-28232 has been patched in version 0.4.8 but that version has not yet been uploaded to Go's package manager.

Key dates

02Disclosure timeline

April 1, 2024 CVE published
August 2, 2024 Record updated