Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
CasaOS-UserService allows unauthorized access to any file
Vulnerability Description
CasaOS-UserService provides user management functionalities to CasaOS. Prior to version 0.4.7, path filtering of the URL for user avatar image files was not strict, making it possible to get any file on the system. This could allow an unauthorized actor to access, for example, the CasaOS user database, and possibly obtain system root privileges. Version 0.4.7 fixes this issue.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Vulnerability Type
信息暴露
Vulnerability Title
CasaOS 安全漏洞
Vulnerability Description
CasaOS是一个简单、易用、优雅的开源家庭云系统。 CasaOS-UserService 0.4.6之前版本存在安全漏洞，该漏洞源于对URL路径过滤不严，导致攻击者可以在系统上获取任何文件。
CVSS Information
N/A
Vulnerability Type
N/A