CVE-2024-24767
Assigner: GitHub_M
Published: 2024-03-06T18:06:26.237Z
State: PUBLISHED
title: CasaOS Improper Restriction of Excessive Authentication Attempts vulnerability
problemTypes: descriptions: cweId: CWE-307
description: CWE-307: Improper Restriction of Excessive Authentication Attempts
type: CWE
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
version: 3.1
affected: vendor: IceWhaleTech
product: CasaOS-UserService
versions: version: >= 0.4.4.3, < 0.4.7
status: affected
descriptions: value: CasaOS-UserService provides user management functionalities to CasaOS. Starting in version 0.4.4.3 and prior to version 0.4.7, CasaOS doesn't defend against password brute force attacks, which leads to having full access to the server. The web application lacks control over the login attempts. This vulnerability allows attackers to get super user-level access over the server. Version 0.4.7 contains a patch for this issue.
source: advisory: GHSA-c69x-5xmw-v44x
discovery: UNKNOWN