CVE-2024-21492

Katalog CVE

CVSS 8.1 · High EPSS 0,71%

Kerentanan Insufficient Session Expiration pada authcrunch caddy-security. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

All versions of the package github.com/greenpau/caddy-security are vulnerable to Insufficient Session Expiration due to improper user session invalidation upon clicking the "Sign Out" button. User sessions remain valid even after requests are sent to /logout and /oauth2/google/logout. Attackers who gain access to an active but supposedly logged-out session can perform unauthorized actions on behalf of the user.

Rincian

Terbit di NVD

17 Februari 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-613: Insufficient Session Expiration

EPSS (30 hari)

0,71% peluang dieksploitasi; lebih tinggi dari 52,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/greenpau/caddy-security/issues/272 issue tracking · advisory vendor
• https://blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-caddy/ exploit · press/media coverage · advisory pihak ketiga
• https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-5920787 advisory pihak ketiga