{"cve":"CVE-2024-24767","nvd":{"published":"2024-03-06T18:15:46.983","modified":"2026-06-17T07:14:49.120","status":"Analyzed","description":"CasaOS-UserService provides user management functionalities to CasaOS. Starting in version 0.4.4.3 and prior to version 0.4.7, CasaOS doesn't defend against password brute force attacks, which leads to having full access to the server. The web application lacks control over the login attempts. This vulnerability allows attackers to get super user-level access over the server. Version 0.4.7 contains a patch for this issue.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-307"],"references":["https://github.com/IceWhaleTech/CasaOS-UserService/commit/62006f61b55951048dbace4ebd9e483274838699","https://github.com/IceWhaleTech/CasaOS-UserService/releases/tag/v0.4.7","https://github.com/IceWhaleTech/CasaOS-UserService/security/advisories/GHSA-c69x-5xmw-v44x","https://github.com/IceWhaleTech/CasaOS-UserService/commit/62006f61b55951048dbace4ebd9e483274838699","https://github.com/IceWhaleTech/CasaOS-UserService/releases/tag/v0.4.7"],"products":["icewhale:casaos"],"source":"nvd","synced_at":"2026-10-19T21:46:54.846886191+00:00"},"epss":{"cve":"CVE-2024-24767","score":0.00977,"percentile":0.62149,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-c69x-5xmw-v44x","url":"https://osv.dev/vulnerability/GHSA-c69x-5xmw-v44x","summary":"CasaOS Improper Restriction of Excessive Authentication Attempts vulnerability","modified":"2026-09-10T03:50:10.234120551Z","packages":[{"ecosystem":"Go","name":"github.com/IceWhaleTech/CasaOS-UserService","purl":"pkg:golang/github.com/IceWhaleTech/CasaOS-UserService","ranges":[">=0.4.4.3 <0.4.7"],"fixed":["0.4.7"]}]},{"id":"GO-2024-2614","url":"https://osv.dev/vulnerability/GO-2024-2614","summary":"Password brute force attack in github.com/IceWhaleTech/CasaOS-UserService","modified":"2024-05-20T16:03:47Z","packages":[{"ecosystem":"Go","name":"github.com/IceWhaleTech/CasaOS-UserService","purl":"pkg:golang/github.com/IceWhaleTech/CasaOS-UserService","ranges":[">=0.4.4-3-alpha1 <0.4.7"],"fixed":["0.4.7"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}