CVE-2024-24765

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

CasaOS-UserService provides user management functionalities to CasaOS. Prior to version 0.4.7, path filtering of the URL for user avatar image files was not strict, making it possible to get any file on the system. This could allow an unauthorized actor to access, for example, the CasaOS user database, and possibly obtain system root privileges. Version 0.4.7 fixes this issue.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Mar 6, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-247667.5CasaOS-UserService provides user management functionalities to CasaOS. Starting in version 0.4.4.3 and prior to version 0.4.7, the Casa OS L CVE-2024-247679.8CasaOS-UserService provides user management functionalities to CasaOS. Starting in version 0.4.4.3 and prior to version 0.4.7, CasaOS doesn'CVE-2024-247687.51Panel is an open source Linux server operation and maintenance management panel. The HTTPS cookie that comes with the panel does not have t CVE-2024-247692.1vantage6 is an open-source infrastructure for privacy preserving analysis. Prior to version 5.0.0, users can reset their MFA token via API r CVE-2024-24775.4The wpDiscuz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Alternative Text' field of an uploaded image in all CVE-2024-247705.3vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Learning and Multi-Par CVE-2024-247715.9Open Forms allows users create and publish smart forms. Versions prior to 2.2.9, 2.3.7, 2.4.5, and 2.5.2 contain a non-exploitable multi-fac CVE-2024-247724.3A guest user could exploit a chart data REST API and send arbitrary SQL statements that on error could leak information from the underlying CVE-2024-247736.5Improper parsing of nested SQL statements on SQLLab would allow authenticated users to surpass their data authorization scope. This issue af CVE-2024-247744.1Mattermost Jira Plugin handling subscriptions fails to check the security level of an incoming issue or limit it based on the user who creat CVE-2024-247757.5When a virtual server is enabled with VLAN group and SNAT listener is configured, undisclosed traffic can cause the Traffic Management Micro CVE-2024-247764.3Mattermost fails to check the required permissions in the POST /api/v4/channels/stats/member_count API resulting in channel member counts be