CVE-2024-48932

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-48932
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-48932.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-48932
Related
  • GHSA-57r9-43pc-gcp2
  • GHSA-9mrr-px2c-w42c
Published
2024-10-24T21:00:27.791Z
Modified
2026-04-02T12:21:00.944742Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
ZimaOS Unauthenticated API Discloses Usernames
Details

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In versions below 1.5.0, the API endpoint http://<Server-ip>/v1/users/name allows unauthenticated users to access sensitive information, such as usernames, without any authorization. This vulnerability could be exploited by an attacker to enumerate usernames and leverage them for further attacks, such as brute-force or phishing campaigns. As of time of publication, no known patched versions are available.

Database specific 
{
    "cwe_ids": [
        "CWE-284"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/48xxx/CVE-2024-48932.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/icewhaletech/zimaos

Affected ranges

Type
GIT
Repo
https://github.com/icewhaletech/zimaos
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
76df65ac82f85bc318fe95556ffb67decde3ae2b

Affected versions

0.*
0.4.8
0.4.8.1
0.4.9
0.4.9.1
0.4.9.2
0.4.9.3
0.4.9.4
0.5.0
1.*
1.0.0
1.1.0
1.2.2
1.2.3
1.2.3-beta1
1.2.4
1.2.4-beta1
1.2.4-beta2
1.2.5
1.2.5-beta1
1.2.5-beta2
1.2.5-beta3
1.3.0
1.3.0-1
1.3.0-2
1.3.0-beta1
1.3.1
1.3.1-1
1.3.1-beta1
1.3.2
1.3.2-1
1.3.2-beta1
1.3.2-beta2
1.3.3
1.3.3-beta1
1.4.0
1.4.0-beta1
1.4.0-beta2
1.4.1
1.4.1-beta1
1.4.1-beta2
1.4.2
1.4.2-beta1
1.4.2-beta2
1.4.3
1.4.4
1.4.4-1
1.4.4-beta1
1.5.0-beta1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-48932.json"