Login
Request a Demo
Research Center
CVE-2022-24193 Research Center

CVE-2022-24193

CasaOS before v0.2.7 was discovered to contain a command injection vulnerability.

  • 9.8 critical severity

  • CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • 10/03/2022

Operating Systems 2

Ca

CasaOS

by Icewhale

110 Versions

a year ago

Ca

CasaOS

by Icewale

110 Versions

a year ago

Vulnerability Categories 1

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

xTags 6

#easy_to_exploit
#critical_vulnerability
#known_vulnerability
#confidentiality_impact_if_exploited
#integrity_impact_if_exploited
#availability_impact_if_exploited

Patch Links 1

https://github.com/IceWhaleTech/CasaOS/commit/d060968b7ab08e7f8cbfe7ca9ccdfa47afe9bb06
Patch Now

Advisory Links 4

https://github.com/IceWhaleTech/CasaOS/issues/84
https://github.com/IceWhaleTech/CasaOS/commit/d060968b7ab08e7f8cbfe7ca9ccdfa47afe9bb06
https://www.star123.top/2022/01/08/A-vulnerability-in-CasaOS/#more
https://www.star123.top/2022/01/08/A-vulnerability-in-CasaOS/
http://www.vicarius.io is owned and operated by Vicarius Ltd. (the “Company”). All information contained on the Website is purely for informational, and educational purposes and should be independently verified and confirmed. Vicarius does not accept any liability for any loss or damage whatsoever caused in reliance upon such information or services. No statements or information presented in any form by Vicarius is intended as fact, and you agree that you will not consider the statements or information presented on the Website as fact or as a guarantee of performance.

Related CVEs

Security Research Topics

By David Parkinson Frost
Jul 19, 2024

Infosec News - Snowblind, BlackSuit, MOVEit, P2PInfect

By David Parkinson Frost
Jun 18, 2024

Infosec News - Stack Overflow, ShinyHunters, LightSpy, OpenAI

By Vicarius Studios .
Jun 18, 2024

Vicarius Studios Presents: These CVEs Were Made for Hackin

By
May 16, 2024

Time Bombs Inside Software: 0-Day Log4Shell is Just the Tip of The Iceberg

A zero-day vulnerability (CVE-2021–44228), known as Log4j or Log4Shell, is vigorously being targeted in the wild. The vulnerability allows an attacker to enter a carefully crafted string of characters into a web form to download malicious code. The result of the exploitation can allow for complete control of the infected system. Jeff Williams, Contrast Security, explains why cyber-threats nowadays are more threatening than they were in the past. He says the nature of cybersecurity threats is different from the challenges we faced in the Past.
By
May 16, 2024

CVE-2022-42856: Adjoining Splittail Vulnerability Report

Apple have reported a vulnerability in WebKit that allows for arbitrary code execution on a client. Exploitation is through maliciously crafted web content. This has been reported as suffering active exploitation against versions of iOS prior to 15.1.
last_chanse_02.png

Start Closing Security Gaps

  • Risk reduction from Day 1
  • Fast set-up and deployment
  • Unified platform
  • Full-featured 14-day trial
Request a Demo