CVE-2024-21499

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-21499
All versions of the package github.com/greenpau/caddy-security are vulnerable to HTTP Header Injection via the X-Forwarded-Proto header due to redirecting to the injected protocol.Exploiting this vulnerability could lead to bypass of security mechanisms or confusion in handling TLS.

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-caddy/
https://github.com/greenpau/caddy-security/issues/270
https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-6249863
https://blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-caddy/
https://github.com/greenpau/caddy-security/issues/270
https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-6249863
Configurations

No configuration.

History

21 Nov 2024, 08:54

Type Values Removed Values Added
References () https://blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-caddy/ - () https://blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-caddy/ -
References () https://github.com/greenpau/caddy-security/issues/270 - () https://github.com/greenpau/caddy-security/issues/270 -
References () https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-6249863 - () https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-6249863 -

20 Feb 2024, 19:50

Type Values Removed Values Added
Summary
  • (es) Todas las versiones del paquete github.com/greenpau/caddy-security son vulnerables a la inyección de encabezado HTTP a través del encabezado X-Forwarded-Proto debido a la redirección al protocolo inyectado. La explotación de esta vulnerabilidad podría provocar la elusión de los mecanismos de seguridad o confusión en el manejo de TLS.

17 Feb 2024, 05:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-17 05:15

Updated : 2024-11-21 08:54

NVD link : CVE-2024-21499

Mitre link : CVE-2024-21499

CVE.ORG link : CVE-2024-21499

JSON object : View

Products Affected

No product.

CWE
CWE-644

Improper Neutralization of HTTP Headers for Scripting Syntax