CVE-2023-37469

    Dashboard / Vulnerabilities / CVE-2023-37469

    CVE-2023-37469

    Published: 24 Aug 2023Last Modified: 12 Aug 2026

    Summary: CasaOS Command Injection vulnerability

    Details: CasaOS is an open-source personal cloud system. Prior to version 0.4.4, if an authenticated user using CasaOS is able to successfully connect to a controlled SMB server, they are able to execute arbitrary commands. Version 0.4.4 contains a patch for the issue.

    References: https://github.com/IceWhaleTech/CasaOS/blob/96e92842357230098c771bc41fd3baf46189b859/route/v1/samba.go#L121, https://github.com/IceWhaleTech/CasaOS/blob/96e92842357230098c771bc41fd3baf46189b859/service/connections.go#L58, https://github.com/IceWhaleTech/CasaOS/releases/tag/v0.4.4, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37469.json, https://nvd.nist.gov/vuln/detail/CVE-2023-37469, https://securitylab.github.com/advisories/GHSL-2022-119_CasaOS/, https://github.com/IceWhaleTech/CasaOS/commit/af440eac5563644854ff33f72041e52d3fd1f47c

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -9d6381d7ac91d51839814a9b350f8782c3042bc3

    Affected versions

    v0.4.4-alpha5
    v0.4.4-alpha4
    v0.4.4-alpha3
    v0.4.4-alpha2
    v0.4.4-alpha1
    v0.4.3-1
    v0.4.3
    v0.4.3-alpha3
    v0.4.3-alpha2
    v0.4.3-alpha1
    v0.4.2
    v0.4.2-alpha9
    v0.4.2-alpha8
    v0.4.2-alpha6
    v0.4.2-alpha5
    v0.4.2-alpha4
    v0.4.2-alpha3
    v0.4.2-alpha2
    v0.4.2-alpha1
    v0.4.1-alpha5
    v0.4.1
    v0.4.1-alpha4
    v0.4.1-alpha3
    v0.4.1-alpha2
    v0.4.1-alpha1
    v0.4.0
    v0.4.0-alpha5
    v0.4.0-alpha4
    v0.4.0-alpha2
    v0.4.0-alpha1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-37469 | CVE-DB