VulnerabilityModified

CVE-2024-48932

In versions below 1.5.0, the API endpoint `http://<Server-ip>/v1/users/name` allows unauthenticated users to access sensitive information, such as usernames, without any authorization.

MEDIUM 5.3EPSS 0.52%

Does this matter?

Lower severity and a low EPSS score (0.52%). Track it; it rarely justifies an emergency change on its own.

Description

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In versions below 1.5.0, the API endpoint `http://<Server-ip>/v1/users/name` allows unauthenticated users to access sensitive information, such as usernames, without any authorization. This vulnerability could be exploited by an attacker to enumerate usernames and leverage them for further attacks, such as brute-force or phishing campaigns. As of time of publication, no known patched versions are available.

CVSS 3.1: 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS: 0.52% probability · 42th percentile
CISA KEV: Not listed
Weakness: CWE-284, CWE-862
Affected: zimaspace/zimaos
Source: security-advisories@github.com

References

https://github.com/IceWhaleTech/ZimaOS/security/advisories/GHSA-57r9-43pc-gcp2
https://github.com/IceWhaleTech/ZimaOS/security/advisories/GHSA-9mrr-px2c-w42cExploit, Vendor Advisory
https://youtu.be/wJFq8cuyFm4Exploit

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.