CVE-2024-21499

low-risk

Published 2024-02-17

All versions of the package github.com/greenpau/caddy-security are vulnerable to HTTP Header Injection via the X-Forwarded-Proto header due to redirecting to the injected protocol.Exploiting this vulnerability could lead to bypass of security mechanisms or confusion in handling TLS.

Do I need to act?

0.03% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 4.3/10 Medium

NETWORK / LOW complexity

Affected Products (1)

Caddy-Security

Affected Vendors

Greenpau

References (6)

Third Party Advisory https://blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-cadd...

Issue Tracking https://github.com/greenpau/caddy-security/issues/270

Third Party Advisory https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-6249863

Third Party Advisory https://blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-cadd...

Issue Tracking https://github.com/greenpau/caddy-security/issues/270

Third Party Advisory https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-6249863

/ 100

low-risk

Severity 18/34 · Moderate

Exploitability 0/34 · Minimal

Exposure 5/34 · Minimal