CVE-2024-28232CWE-204

Username Enumeration in CasaOS via bypass of CVE-2024-24766

Medium · published April 1, 2024

CVSS v3.1
6.2
EPSS
1%
Percentile
49.0
In the wild
Unconfirmed
What it is

Go package IceWhaleTech/CasaOS-UserService provides user management functionalities to CasaOS. The Casa OS Login page has disclosed the username enumeration vulnerability in the login page which was patched in version 0.4.7. This issue in CVE-2024-28232 has been patched in version 0.4.8 but that version has not yet been uploaded to Go's package manager.

The record
Technical detail
CVSS v3.1
6.2 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00618 · 49.0th percentile
Weakness
CWE-204 · Observable Response Discrepancy
Published
2024-04-01T16:42Z
EPSS history
Timeline
  • 01 APR 16:42Z
    Username Enumeration in CasaOS via bypass of CVE-2024-24766
    cvelistv5