PT-2024-22632 · Gocast+1 · Gocast+1

Edwin Molenaar + 1 · Published 2024-11-21 · Updated 2025-01-10 · CVE-2024-28892

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GoCast version 1.1.3

Description An OS command injection issue exists in the name parameter of GoCast, allowing arbitrary command execution via a specially crafted HTTP request. This can be triggered by an unauthenticated HTTP request.

Recommendations For GoCast version 1.1.3, consider restricting access to the name parameter to minimize the risk of exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2024-28892

GHSA-5QWW-56GC-F66C

GO-2024-3359

OPENSUSE-SU-2025:14624-1

OPENSUSE-SU-2025_0060-1

SUSE-SU-2025:0060-1

Affected Products

Gocast

Suse

References · 31

• https://nvd.nist.gov/vuln/detail/CVE-2024-28892 · Security Note
• https://osv.dev/vulnerability/GHSA-5qww-56gc-f66c · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:0060-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-3359 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:14624-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-28892 · Vendor Advisory
• https://github.com/mayuresh82/gocast · Note
• https://github.com/advisories/GHSA-5qww-56gc-f66c · Note
• https://talosintelligence.com/vulnerability_reports/TALOS-2024-1960 · Note
• https://suse.com/security/cve/CVE-2024-12678 · Note
• https://suse.com/security/cve/CVE-2024-54148 · Note
• https://lists.opensuse.org/archives/list/[e-mail]/thread/UV63VQGB6Y3V7AIZHIKF3PMFVIHM32MI · Note
• https://suse.com/security/cve/CVE-2024-55196 · Note
• https://suse.com/security/cve/CVE-2024-55947 · Note
• https://suse.com/security/cve/CVE-2025-21609 · Note