CVE-2024-24765: icewhale casaos

csirt@kutim:~/threat-intel/cve/CVE-2024-24765

CVSS 9.8 · Critical EPSS 0,97%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada icewhale casaos. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

CasaOS-UserService provides user management functionalities to CasaOS. Prior to version 0.4.7, path filtering of the URL for user avatar image files was not strict, making it possible to get any file on the system. This could allow an unauthorized actor to access, for example, the CasaOS user database, and possibly obtain system root privileges. Version 0.4.7 fixes this issue.

Rincian

Terbit di NVD: 6 Maret 2024
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
EPSS (30 hari): 0,97% peluang dieksploitasi; lebih tinggi dari 60,9% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
icewhale	casaos	Semua versi sebelum 0.4.7

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/IceWhaleTech/CasaOS-UserService/security/advisories/GHSA-h5gf-cmm8-cg7c exploit · advisory vendor
https://github.com/IceWhaleTech/CasaOS-UserService/commit/3f4558e23c0a9958f9a0e20aabc64aa8fd51840e patch
https://github.com/IceWhaleTech/CasaOS-UserService/releases/tag/v0.4.7 release notes

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.