VULNERABILITY INTELLIGENCE

CVE-2024-28232

CVSS score6.2 MEDIUM

EPSS probability0.62%

CISA KEVNot currently listed

Published2024-04-01

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Description

Go package IceWhaleTech/CasaOS-UserService provides user management functionalities to CasaOS. The Casa OS Login page has disclosed the username enumeration vulnerability in the login page which was patched in version 0.4.7. This issue in CVE-2024-28232 has been patched in version 0.4.8 but that version has not yet been uploaded to Go's package manager.

Weakness classification

CWE-204: Observable Response Discrepancy

Primary references

security-advisories@github.com — Patch
security-advisories@github.com — Exploit, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Patch
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Vendor Advisory