CVE-2024-21497

Katalog CVE

CVSS 6.1 · Medium EPSS 0,50%

Kerentanan URL Redirection to Untrusted Site ('Open Redirect') pada greenpau caddy-security. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

Versions of the package github.com/greenpau/caddy-security are vulnerable to Open Redirect via the redirect_url parameter. An attacker could perform a phishing attack and trick users into visiting a malicious website by crafting a convincing URL with this parameter. To exploit this vulnerability, the user must take an action, such as clicking on a portal button or using the browser’s back button, to trigger the redirection.

Rincian

Terbit di NVD

17 Februari 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-601: URL Redirection to Untrusted Site ('Open Redirect')

EPSS (30 hari)

0,50% peluang dieksploitasi; lebih tinggi dari 41,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-caddy/ mitigasi · advisory pihak ketiga
• https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-6249861 advisory pihak ketiga
• https://github.com/greenpau/caddy-security/issues/268 issue tracking