CVE-2024-28232
Login username enumeration in github.com/IceWhaleTech/CasaOS-UserService
Description
The Casa OS Login page has a username enumeration vulnerability in the login page that was patched in Casa OS v0.4.7. The issue exists because the application response differs depending on whether the username or password is incorrect, allowing an attacker to enumerate usernames by observing the application response. For example, if the username is incorrect, the application returns "User does not exist" with return code "10006", while if the password is incorrect, it returns "User does not exist or password is invalid" with return code "10013". This allows an attacker to determine if a username exists without knowing the password.
How to fix CVE-2024-28232
To remediate CVE-2024-28232, upgrade the affected package to a fixed version below.
- —upgrade to 0.4.8 or later
- —upgrade to 0.4.8 or later
Is CVE-2024-28232 being exploited?
Low — EPSS is 0.3%, meaning exploitation activity has not been observed at scale.
Affected packages (2)
- >= 0.4.7, < 0.4.8
- from 0, < 0.4.8
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM6.2 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |