CVE-2024-49358
ZimaOS vulnerable to Username Enumeration via API Responses
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
ZimaOS vulnerable to Username Enumeration via API Responses
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the API endpoint `http://<Server-IP>/v1/users/login` in ZimaOS returns distinct responses based on whether a username exists or the password is incorrect. This behavior can be exploited for username enumeration, allowing attackers to determine whether a user exists in the system or not. Attackers can leverage this information in further attacks, such as credential stuffing or targeted password brute-forcing. As of time of publication, no known patched versions are available.
Reserved 2024-10-14 | Published 2024-10-24 | Updated 2024-10-25 | Assigner GitHub_MCWE-203: Observable Discrepancy
github.com/...ZimaOS/security/advisories/GHSA-3f6g-8r88-3mx5
Support options
