CVE-2024-24767
CasaOS Improper Restriction of Excessive Authentication Attempts vulnerability
- State
- Published
- Severity
- 9.1 Critical
- Published
- Mar 6, 2024
- Updated
- Aug 28, 2024
- Reserved
- Jan 29, 2024
Description
CasaOS-UserService provides user management functionalities to CasaOS. Starting in version 0.4.4.3 and prior to version 0.4.7, CasaOS doesn't defend against password brute force attacks, which leads to having full access to the server. The web application lacks control over the login attempts. This vulnerability allows attackers to get super user-level access over the server. Version 0.4.7 contains a patch for this issue.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 9.1 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N | GitHub_M |
Weaknesses
- CWE-307 Improper Restriction of Excessive Authentication Attempts
Affected Products
| Product | Versions |
|---|---|
CasaOS-UserServiceIceWhaleTech |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.