Github.Com Icewhaletech Casaos vulnerabilities
3 known vulnerabilities affecting github.com/icewhaletech_casaos.
Total CVEs
3
CISA KEV
0
Public exploits
1
Exploited in wild
0
Severity breakdown
CRITICAL3
Vulnerabilities
Page 1 of 1
CVE-2023-37266P2CRITICALPoC≥ 0, < 0.4.42023-07-17
CVE-2023-37266 [CRITICAL] CWE-1391 CasaOS contains weak JWT secrets
CasaOS contains weak JWT secrets
### Impact
Unauthenticated attackers can craft arbitrary JWTs and access features that usually require authentication and execute arbitrary commands as `root` on CasaOS instances.
### Patches
The problem was addressed by improving the validation of JWTs in 705bf1f. This patch is part of CasaOS 0.4.4.
### Workarounds
Users should upgrade to CasaOS 0.4.4. If they can't, they should temporaril
ghsaosv
CVE-2022-24193P2CRITICAL≥ 0, < 0.2.82022-03-11
CVE-2022-24193 [CRITICAL] CWE-78 Command Injection in CasaOS
Command Injection in CasaOS
CasaOS before v0.2.7 was discovered to contain a command injection vulnerability via the component leave or join zerotier api.
ghsaosv
CVE-2023-37469P3CRITICAL≥ 0, < 0.4.42024-08-05
CVE-2023-37469 [CRITICAL] CWE-77 CasaOS Command Injection vulnerability
CasaOS Command Injection vulnerability
CasaOS is an open-source personal cloud system. Prior to version 0.4.4, if an authenticated user using CasaOS is able to successfully connect to a controlled SMB server, they are able to execute arbitrary commands. Version 0.4.4 contains a patch for the issue.
ghsaosv