CVE-2023-37469

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

CasaOS is an open-source personal cloud system. Prior to version 0.4.4, if an authenticated user using CasaOS is able to successfully connect to a controlled SMB server, they are able to execute arbitrary commands. Version 0.4.4 contains a patch for the issue.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

Vendor	Product	Versions
IceWhaleTech	CasaOS	< 0.4.4
icewhaletech	casaos-userservice	< 0.4.4

References

Timeline

Published: Aug 24, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-37475.5Zero Trust Administrators have the ability to disallow end users from disabling WARP on their devices. Override codes can also be created by CVE-2023-374709.8Metabase is an open-source business intelligence and analytics platform. Prior to versions 0.43.7.3, 0.44.7.3, 0.45.4.3, 0.46.6.4, 1.43.7.3,CVE-2023-374719.8Open Access Management (OpenAM) is an access management solution that includes Authentication, SSO, Authorization, Federation, Entitlements CVE-2023-374726.5Knowage is an open source suite for business analytics. The application often use user supplied data to create HQL queries without prior san CVE-2023-374738.8zenstruck/collections is a set of helpers for iterating/paginating/filtering collections. Passing _callable strings_ (ie `system`) caused th CVE-2023-374747.5Copyparty is a portable file server. Versions prior to 1.8.2 are subject to a path traversal vulnerability detected in the `.cpr` subfolder.CVE-2023-374757.5Hamba avro is a go lang encoder/decoder implementation of the avro codec specification. In affected versions a well-crafted string passed to CVE-2023-374767.8OpenRefine is a free, open source tool for data processing. A carefully crafted malicious OpenRefine project tar file can be used to trigger CVE-2023-374778.81Panel is an open source Linux server operation and maintenance management panel. An OS command injection vulnerability exists in 1Panel fir CVE-2023-374789.8pnpm is a package manager. It is possible to construct a tarball that, when installed via npm or parsed by the registry is safe, but when in CVE-2023-374797.5Open Enclave is a hardware-agnostic open source library for developing applications that utilize Hardware-based Trusted Execution Environmen CVE-2023-37487.5A flaw was found in FRRouting when parsing certain babeld unicast hello messages that are intended to be ignored. This issue may allow an at