CVE-2024-28232
Username Enumeration in CasaOS via bypass of CVE-2024-24766
- State
- Published
- Severity
- 6.2 Medium
- Published
- Apr 1, 2024
- Updated
- Aug 2, 2024
- Reserved
- Mar 7, 2024
Description
Go package IceWhaleTech/CasaOS-UserService provides user management functionalities to CasaOS. The Casa OS Login page has disclosed the username enumeration vulnerability in the login page which was patched in version 0.4.7. This issue in CVE-2024-28232 has been patched in version 0.4.8 but that version has not yet been uploaded to Go's package manager.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.2 Medium | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | GitHub_M |
Weaknesses
- CWE-204 Observable Response Discrepancy
Affected Products
| Product | Versions |
|---|---|
CasaOS-UserServiceIceWhaleTech |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.