Lucene search

GitHub_MCVE-2023-37265

HistoryJul 17, 2023 - 9:15 p.m.

CVE-2023-37265

2023-07-1721:15:09

CWE-306

GitHub_M

web.nvd.nist.gov

casaos

cve-2023-37265

security

vulnerability

ip verification

arbitrary commands

root access

patch

nvd

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.032

Percentile

91.4%

JSON

CasaOS is an open-source Personal Cloud system. Due to a lack of IP address verification an unauthenticated attackers can execute arbitrary commands as root on CasaOS instances. The problem was addressed by improving the detection of client IP addresses in 391dd7f. This patch is part of CasaOS 0.4.4. Users should upgrade to CasaOS 0.4.4. If they can’t, they should temporarily restrict access to CasaOS to untrusted users, for instance by not exposing it publicly.

Affected configurations

Nvd

Vulners

Node

icewhalecasaosRange<0.4.4

icewhalecasaosMatch0.4.4alpha1

icewhalecasaosMatch0.4.4alpha2

icewhalecasaosMatch0.4.4alpha3

icewhalecasaosMatch0.4.4alpha4

icewhalecasaosMatch0.4.4alpha5

Node

icewhalecasaos-gatewayRange<0.4.4

icewhalecasaos-gatewayMatch0.4.4alpha1

VendorProductVersionCPE
icewhalecasaos*cpe:2.3:o:icewhale:casaos:*:*:*:*:*:*:*:*
icewhalecasaos0.4.4cpe:2.3:o:icewhale:casaos:0.4.4:alpha1:*:*:*:*:*:*
icewhalecasaos0.4.4cpe:2.3:o:icewhale:casaos:0.4.4:alpha2:*:*:*:*:*:*
icewhalecasaos0.4.4cpe:2.3:o:icewhale:casaos:0.4.4:alpha3:*:*:*:*:*:*
icewhalecasaos0.4.4cpe:2.3:o:icewhale:casaos:0.4.4:alpha4:*:*:*:*:*:*
icewhalecasaos0.4.4cpe:2.3:o:icewhale:casaos:0.4.4:alpha5:*:*:*:*:*:*
icewhalecasaos-gateway*cpe:2.3:a:icewhale:casaos-gateway:*:*:*:*:*:*:*:*
icewhalecasaos-gateway0.4.4cpe:2.3:a:icewhale:casaos-gateway:0.4.4:alpha1:*:*:*:*:*:*

Vendor	Product	Version	CPE
icewhale	casaos	*	cpe:2.3:o:icewhale:casaos::::::::
icewhale	casaos	0.4.4	cpe:2.3:o:icewhale:casaos:0.4.4:alpha1::::::
icewhale	casaos	0.4.4	cpe:2.3:o:icewhale:casaos:0.4.4:alpha2::::::
icewhale	casaos	0.4.4	cpe:2.3:o:icewhale:casaos:0.4.4:alpha3::::::
icewhale	casaos	0.4.4	cpe:2.3:o:icewhale:casaos:0.4.4:alpha4::::::
icewhale	casaos	0.4.4	cpe:2.3:o:icewhale:casaos:0.4.4:alpha5::::::
icewhale	casaos-gateway	*	cpe:2.3:a:icewhale:casaos-gateway::::::::
icewhale	casaos-gateway	0.4.4	cpe:2.3:a:icewhale:casaos-gateway:0.4.4:alpha1::::::

CNA Affected

[
  {
    "vendor": "IceWhaleTech",
    "product": "CasaOS-Gateway",
    "versions": [
      {
        "version": "< 0.4.4",
        "status": "affected"
      }
    ]
  }
]