CVE-2024-21495

Katalog CVE

CVSS 9.8 · Critical EPSS 0,68%

Kerentanan Use of Insufficiently Random Values pada greenpau caddy-security. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Versions of the package github.com/greenpau/caddy-security before 1.0.42 are vulnerable to Insecure Randomness due to using an insecure random number generation library which could possibly be predicted via a brute-force search. Attackers could use the potentially predictable nonce value used for authentication purposes in the OAuth flow to conduct OAuth replay attacks. In addition, insecure randomness is used while generating multifactor authentication (MFA) secrets and creating API keys in the database package.

Rincian

Terbit di NVD

17 Februari 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-330: Use of Insufficiently Random Values

EPSS (30 hari)

0,68% peluang dieksploitasi; lebih tinggi dari 51,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/greenpau/go-authcrunch/commit/ecd3725baf2683eb1519bb3c81ae41085fbf7dc2 patch
• https://blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-caddy/ advisory pihak ketiga
• https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-6248275 advisory pihak ketiga
• https://github.com/greenpau/caddy-security/issues/265 issue tracking