Lucene search
PRIOn knowledge basePRION:CVE-2023-37265HistoryJul 17, 2023 - 9:15 p.m.
Design/Logic Flaw
2023-07-1721:15:00
PRIOn knowledge base
www.prio-n.com
15
casaos
root command execution
upgrade required
ip address verification
unauthenticated attackers
open-source
personal cloud system
patch
logic flaw
CasaOS is an open-source Personal Cloud system. Due to a lack of IP address verification an unauthenticated attackers can execute arbitrary commands as root on CasaOS instances. The problem was addressed by improving the detection of client IP addresses in 391dd7f. This patch is part of CasaOS 0.4.4. Users should upgrade to CasaOS 0.4.4. If they can’t, they should temporarily restrict access to CasaOS to untrusted users, for instance by not exposing it publicly.
| CPE | Name | Operator | Version |
|---|---|---|---|
| casaos | eq | 0.4.4 alpha1 | |
| casaos | eq | 0.4.4 alpha2 | |
| casaos | eq | 0.4.4 alpha3 | |
| casaos | eq | 0.4.4 alpha4 | |
| casaos | eq | 0.4.4 alpha5 | |
| casaos | lt | 0.4.4 | |
| casaos-gateway | lt | 0.4.4 | |
| casaos-gateway | eq | 0.4.4 alpha1 |
Related
cve
cve
CVE-2023-37265
2023-07-17 21:15:09
nvd
nvd
CVE-2023-37265
2023-07-17 21:15:09
osv
osv
CasaOS Gateway vulnerable to incorrect identification of source IP addresses
2023-07-17 14:36:09
CVE-2023-37265
2023-07-17 21:15:09
cvelist
cvelist
CVE-2023-37265 Incorrect identification of source IP addresses in CasaOS
2023-07-17 20:59:25
nuclei
nuclei
CasaOS < 0.4.4 - Authentication Bypass via Internal IP
2023-07-27 09:11:18
veracode
veracode
Lack Of IP Address Verification
2023-07-19 02:28:54
gitlab
gitlab
Missing Authentication for Critical Function
2023-07-17 00:00:00
github
github
CasaOS Gateway vulnerable to incorrect identification of source IP addresses
2023-07-17 14:36:09
thn
thn
Critical Vulnerabilities Uncovered in Open Source CasaOS Cloud Software
2023-10-17 14:37:00