CVE-2023-37266 Vulnerability Details

  /     /     /  

CVE-2023-37266 Metadata Quick Info

CVE Published: 17/07/2023 | CVE Updated: 10/10/2024 | CVE Year: 2023
Source: GitHub_M | Vendor: IceWhaleTech | Product: CasaOS
Status : PUBLISHED

---

CVE-2023-37266 Description

CasaOS is an open-source Personal Cloud system. Unauthenticated attackers can craft arbitrary JWTs and access features that usually require authentication and execute arbitrary commands as `root` on CasaOS instances. This problem was addressed by improving the validation of JWTs in commit `705bf1f`. This patch is part of CasaOS 0.4.4. Users should upgrade to CasaOS 0.4.4. If they can\'t, they should temporarily restrict access to CasaOS to untrusted users, for instance by not exposing it publicly.

Metrics

CVSS Version: 3.1 | Base Score: 9.8 CRITICAL
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

l➤ Exploitability Metrics:
    Attack Vector (AV)* NETWORK
    Attack Complexity (AC)* LOW
    Privileges Required (PR)* NONE
    User Interaction (UI)* NONE
    Scope (S)* UNCHANGED

l➤ Impact Metrics:
    Confidentiality Impact (C)* HIGH
    Integrity Impact (I)* HIGH
    Availability Impact (A)* HIGH

Weakness Enumeration (CWE)

CWE-ID: CWE-287
CWE Name: CWE-287: Improper Authentication
Source: IceWhaleTech

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).