Lucene search
PRIOn knowledge basePRION:CVE-2023-37266HistoryJul 17, 2023 - 9:15 p.m.
Design/Logic Flaw
2023-07-1721:15:00
PRIOn knowledge base
www.prio-n.com
5
casaos
open-source
personal cloud system
unauthenticated attackers
jwts
commit 705bf1f
validation
patch
casaos 0.4.4
upgrade
temporary access restriction
untrusted users
security vulnerability
CasaOS is an open-source Personal Cloud system. Unauthenticated attackers can craft arbitrary JWTs and access features that usually require authentication and execute arbitrary commands as root on CasaOS instances. This problem was addressed by improving the validation of JWTs in commit 705bf1f. This patch is part of CasaOS 0.4.4. Users should upgrade to CasaOS 0.4.4. If they can’t, they should temporarily restrict access to CasaOS to untrusted users, for instance by not exposing it publicly.
Related
nvd
nvd
CVE-2023-37266
2023-07-17 21:15:09
gitlab
gitlab
Improper Authentication
2023-07-17 00:00:00
github
github
CasaOS contains weak JWT secrets
2023-07-17 14:40:16
cvelist
cvelist
CVE-2023-37266 Weak json web token (JWT) secrets in CasaOS
2023-07-17 20:57:43
osv
osv
CasaOS contains weak JWT secrets
2023-07-17 14:40:16
veracode
veracode
Weak JWT Secrets
2023-07-19 02:08:57
nuclei
nuclei
CasaOS < 0.4.4 - Authentication Bypass via Random JWT Token
2023-07-27 09:11:18
cnvd
cnvd
CasaOS Encryption Issues Vulnerabilities
2023-07-19 00:00:00
cve
cve
CVE-2023-37266
2023-07-17 21:15:09
thn
thn
Critical Vulnerabilities Uncovered in Open Source CasaOS Cloud Software
2023-10-17 14:37:00