Lucene search

GitHub_MCVELIST:CVE-2023-37469

HistoryAug 24, 2023 - 10:12 p.m.

CVE-2023-37469 CasaOS Command Injection vulnerability

2023-08-2422:12:10

CWE-77

GitHub_M

www.cve.org

casaos

command injection

vulnerability

smb server

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.001

Percentile

38.4%

JSON

CasaOS is an open-source personal cloud system. Prior to version 0.4.4, if an authenticated user using CasaOS is able to successfully connect to a controlled SMB server, they are able to execute arbitrary commands. Version 0.4.4 contains a patch for the issue.

CNA Affected

[
  {
    "vendor": "IceWhaleTech",
    "product": "CasaOS",
    "versions": [
      {
        "version": "< 0.4.4",
        "status": "affected"
      }
    ]
  }
]

References

github.com/IceWhaleTech/CasaOS/blob/96e92842357230098c771bc41fd3baf46189b859/route/v1/samba.go#L121

github.com/IceWhaleTech/CasaOS/blob/96e92842357230098c771bc41fd3baf46189b859/service/connections.go#L58

github.com/IceWhaleTech/CasaOS/commit/af440eac5563644854ff33f72041e52d3fd1f47c

github.com/IceWhaleTech/CasaOS/releases/tag/v0.4.4

securitylab.github.com/advisories/GHSL-2022-119_CasaOS/

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.001

Percentile

38.4%

JSON

Related for CVELIST:CVE-2023-37469