ByteOS Network

CVE Vulnerability Details :

CVE-2023-37265

PUBLISHED

More Info Official Page

Assigner-GitHub_M

Assigner Org ID-a0819718-46f1-4df5-94e2-005712e83aaa

Published At-17 Jul, 2023 | 20:59

Updated At-12 Dec, 2024 | 20:45

▼CVE Numbering Authority (CNA)

Incorrect identification of source IP addresses in CasaOS

CasaOS is an open-source Personal Cloud system. Due to a lack of IP address verification an unauthenticated attackers can execute arbitrary commands as `root` on CasaOS instances. The problem was addressed by improving the detection of client IP addresses in `391dd7f`. This patch is part of CasaOS 0.4.4. Users should upgrade to CasaOS 0.4.4. If they can't, they should temporarily restrict access to CasaOS to untrusted users, for instance by not exposing it publicly.

Affected Products

Vendor

IceWhaleTech

Product

CasaOS-Gateway

Versions

Affected

< 0.4.4

Problem Types

Type	CWE ID	Description
CWE	CWE-306	CWE-306: Missing Authentication for Critical Function

Metrics

Version	Base score	Base severity	Vector
3.1	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Hyperlink	Resource
https://github.com/IceWhaleTech/CasaOS-Gateway/security/advisories/GHSA-vjh7-5r6x-xh6g	x_refsource_CONFIRM
https://github.com/IceWhaleTech/CasaOS-Gateway/commit/391dd7f0f239020c46bf057cfa25f82031fc15f7	x_refsource_MISC
https://www.sonarsource.com/blog/security-vulnerabilities-in-casaos	x_refsource_MISC

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
https://github.com/IceWhaleTech/CasaOS-Gateway/security/advisories/GHSA-vjh7-5r6x-xh6g	x_refsource_CONFIRM x_transferred
https://github.com/IceWhaleTech/CasaOS-Gateway/commit/391dd7f0f239020c46bf057cfa25f82031fc15f7	x_refsource_MISC x_transferred

2. CISA ADP Vulnrichment

Affected Products

Vendor

icewhale

Product

casaos-gateway

CPEs

cpe:2.3:a:icewhale:casaos-gateway:*:*:*:*:*:*:*:*

Default Status

unknown

Versions

Affected

From 0 before 0.4.4 (custom)

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Affected

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References