CVE-2024-28232

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-28232
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-28232.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-28232
Aliases
Published
2024-04-01T16:42:05.726Z
Modified
2026-07-15T01:48:52.283593570Z
Severity
  • 6.2 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Username Enumeration in CasaOS via bypass of CVE-2024-24766
Details

Go package IceWhaleTech/CasaOS-UserService provides user management functionalities to CasaOS. The Casa OS Login page has disclosed the username enumeration vulnerability in the login page which was patched in version 0.4.7. This issue in CVE-2024-28232 has been patched in version 0.4.8 but that version has not yet been uploaded to Go's package manager.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28232.json",
    "cwe_ids": [
        "CWE-204"
    ]
}
References

Affected packages

Git / github.com/icewhaletech/casaos-userservice

Affected ranges

Type
GIT
Repo
https://github.com/icewhaletech/casaos-userservice
Events
Introduced
7bd0df6441c25c322460f75c55bf18fe908441f9
Fixed
dd927fe1c805e53790f73cfe10c7a4ded3bc5bdb
Database specific 
{
    "cpe": "cpe:2.3:a:icewhale:casaos-userservice:0.4.7:-:*:*:*:*:*:*",
    "source": [
        "CPE_STRING",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0.4.7-NA"
        },
        {
            "last_affected": "0.4.7-NA"
        }
    ]
}

Affected versions

0.*
0.4.7-NA
= 0.*
= 0.4.7
v0.*
v0.4.6-alpha3
v0.4.7
v0.4.7-alpha1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-28232.json"