CVE-2024-24765

2024-03-0618:15:46

Google

osv.dev

casaos

userservice

url path filtering

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.2 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.7%

JSON

CasaOS-UserService provides user management functionalities to CasaOS. Prior to version 0.4.7, path filtering of the URL for user avatar image files was not strict, making it possible to get any file on the system. This could allow an unauthorized actor to access, for example, the CasaOS user database, and possibly obtain system root privileges. Version 0.4.7 fixes this issue.

CPENameOperatorVersion
casaos-userserviceeq0.4.4-alpha3
casaos-userserviceeq0.3.5-alpha1
casaos-userserviceeq0.3.6-alpha4
casaos-userserviceeq0.3.7
casaos-userserviceeq0.3.5-alpha2
casaos-userserviceeq0.4.0-alpha1
casaos-userserviceeq0.3.6-alpha7
casaos-userserviceeq0.3.5-alpha3
casaos-userserviceeq0.4.4
casaos-userserviceeq0.3.6-alpha3

Name	Operator	Version
casaos-userservice	eq	0.4.4-alpha3
casaos-userservice	eq	0.3.5-alpha1
casaos-userservice	eq	0.3.6-alpha4
casaos-userservice	eq	0.3.7
casaos-userservice	eq	0.3.5-alpha2
casaos-userservice	eq	0.4.0-alpha1
casaos-userservice	eq	0.3.6-alpha7
casaos-userservice	eq	0.3.5-alpha3
casaos-userservice	eq	0.4.4
casaos-userservice	eq	0.3.6-alpha3