Icewhale

Casaos

7 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
5.3

CVE-2025-34171

  • EPSS 0.06%
  • Veröffentlicht 02.01.2026 17:15:45
  • Zuletzt bearbeitet 26.02.2026 21:57:55

CasaOS versions up to and including 0.4.15 expose multiple unauthenticated endpoints that allow remote attackers to retrieve sensitive configuration files and system debug information. The /v1/users/image endpoint can be abused with a user-controlled...

9.8

CVE-2024-24765

Exploit
  • EPSS 0.46%
  • Veröffentlicht 06.03.2024 18:15:46
  • Zuletzt bearbeitet 26.02.2025 15:14:55

CasaOS-UserService provides user management functionalities to CasaOS. Prior to version 0.4.7, path filtering of the URL for user avatar image files was not strict, making it possible to get any file on the system. This could allow an unauthorized ac...

9.8

CVE-2024-24767

Exploit
  • EPSS 0.73%
  • Veröffentlicht 06.03.2024 18:15:46
  • Zuletzt bearbeitet 10.04.2025 20:31:56

CasaOS-UserService provides user management functionalities to CasaOS. Starting in version 0.4.4.3 and prior to version 0.4.7, CasaOS doesn't defend against password brute force attacks, which leads to having full access to the server. The web applic...

8.8

CVE-2023-37469

Exploit
  • EPSS 0.41%
  • Veröffentlicht 24.08.2023 23:15:08
  • Zuletzt bearbeitet 21.11.2024 08:11:46

CasaOS is an open-source personal cloud system. Prior to version 0.4.4, if an authenticated user using CasaOS is able to successfully connect to a controlled SMB server, they are able to execute arbitrary commands. Version 0.4.4 contains a patch for ...

9.8

CVE-2023-37265

Exploit
  • EPSS 91.12%
  • Veröffentlicht 17.07.2023 21:15:09
  • Zuletzt bearbeitet 07.04.2025 13:54:26

CasaOS is an open-source Personal Cloud system. Due to a lack of IP address verification an unauthenticated attackers can execute arbitrary commands as `root` on CasaOS instances. The problem was addressed by improving the detection of client IP addr...

9.8

CVE-2023-37266

Exploit
  • EPSS 89.16%
  • Veröffentlicht 17.07.2023 21:15:09
  • Zuletzt bearbeitet 10.04.2025 20:31:47

CasaOS is an open-source Personal Cloud system. Unauthenticated attackers can craft arbitrary JWTs and access features that usually require authentication and execute arbitrary commands as `root` on CasaOS instances. This problem was addressed by imp...

9.8

CVE-2022-24193

Exploit
  • EPSS 19.34%
  • Veröffentlicht 10.03.2022 17:45:59
  • Zuletzt bearbeitet 21.11.2024 06:49:59

CasaOS before v0.2.7 was discovered to contain a command injection vulnerability.