CVE-2023-37266

Katalog CVE

CVSS 9.8 · Critical EPSS 6,8%

Kerentanan Improper Authentication pada icewhale casaos. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

CasaOS is an open-source Personal Cloud system. Unauthenticated attackers can craft arbitrary JWTs and access features that usually require authentication and execute arbitrary commands as `root` on CasaOS instances. This problem was addressed by improving the validation of JWTs in commit `705bf1f`. This patch is part of CasaOS 0.4.4. Users should upgrade to CasaOS 0.4.4. If they can't, they should temporarily restrict access to CasaOS to untrusted users, for instance by not exposing it publicly.

Rincian

Terbit di NVD

17 Juli 2023

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication

EPSS (30 hari)

6,8% peluang dieksploitasi; lebih tinggi dari 93,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/IceWhaleTech/CasaOS/commit/705bf1facbffd2ca40b159b0303132b6fdf657ad patch
• https://github.com/IceWhaleTech/CasaOS/security/advisories/GHSA-m5q5-8mfw-p2hr patch · advisory pihak ketiga
• https://www.sonarsource.com/blog/security-vulnerabilities-in-casaos exploit · advisory pihak ketiga