VDB
Sign up
—

GO-2024-2615

Username enumeration in github.com/IceWhaleTech/CasaOS-UserService

Quick fix

GO-2024-2615 — github.com/IceWhaleTech/CasaOS-UserService: upgrade to the fixed version with the command below.

go get github.com/IceWhaleTech/CasaOS-UserService@v0.4.7

Details

CasaOS-UserService is vulnerable to a username enumeration issue, when an attacker can enumerate the CasaOS username using the application response. If the username is incorrect, the application gives the error 'User does not exist'. If the password is incorrect, the application gives the error 'Invalid password'.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/IceWhaleTech/CasaOS-UserService
Introduced in: 0.4.4-3-alpha1Fixed in: 0.4.7
Fixgo get github.com/IceWhaleTech/CasaOS-UserService@v0.4.7

References