Lucene search

[email protected]CVE-2023-37469

HistoryAug 24, 2023 - 11:15 p.m.

CVE-2023-37469

2023-08-2423:15:08

CWE-77

[email protected]

web.nvd.nist.gov

casaos

open-source

personal cloud

cve-2023-37469

security vulnerability

smb

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

23.8%

JSON

CasaOS is an open-source personal cloud system. Prior to version 0.4.4, if an authenticated user using CasaOS is able to successfully connect to a controlled SMB server, they are able to execute arbitrary commands. Version 0.4.4 contains a patch for the issue.

Affected configurations

Vulners

NVD

Node

icewhaletechcasaosRange<0.4.4

CPENameOperatorVersion
icewhale:casaosicewhale casaoslt0.4.4

CPE	Name	Operator	Version
icewhale:casaos	icewhale casaos	lt	0.4.4

CNA Affected

[
  {
    "vendor": "IceWhaleTech",
    "product": "CasaOS",
    "versions": [
      {
        "version": "< 0.4.4",
        "status": "affected"
      }
    ]
  }
]

References

github.com/IceWhaleTech/CasaOS/blob/96e92842357230098c771bc41fd3baf46189b859/route/v1/samba.go#L121

github.com/IceWhaleTech/CasaOS/blob/96e92842357230098c771bc41fd3baf46189b859/service/connections.go#L58

github.com/IceWhaleTech/CasaOS/commit/af440eac5563644854ff33f72041e52d3fd1f47c

github.com/IceWhaleTech/CasaOS/releases/tag/v0.4.4

securitylab.github.com/advisories/GHSL-2022-119_CasaOS/

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

23.8%

JSON

Related for CVE-2023-37469

cvelist1 prion1 nvd1