Vulnerability · Published Feb 17, 2024 · Assigned by snyk
CVE-2024-21497
Medium 5.4
In plain English
A medium-severity open redirect in github.com/greenpau/caddy-security. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).
Official description
Versions of the package github.com/greenpau/caddy-security are vulnerable to Open Redirect via the redirect_url parameter. An attacker could perform a phishing attack and trick users into visiting a malicious website by crafting a convincing URL with this parameter. To exploit this vulnerability, the user must take an action, such as clicking on a portal button or using the browser’s back button, to trigger the redirection.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/greenpau/caddy-security | no fix listed | GHSA-8hp3-rmr7-xh88 |
| Go | github.com/greenpau/caddy-security | no fix listed | GO-2024-2560 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | github.com/greenpau/caddy-security | 0 – before * |
Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P