CVE-2024-21500

low-risk
Published 2024-02-17

All versions of the package github.com/greenpau/caddy-security are vulnerable to Improper Restriction of Excessive Authentication Attempts via the two-factor authentication (2FA). Although the application blocks the user after several failed attempts to provide 2FA codes, attackers can bypass this blocking mechanism by automating the application’s full multistep 2FA process.

Do I need to act?

-
0.05% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
4
CVSS 4.8/10 Medium
NETWORK / HIGH complexity

Affected Products (1)

Caddy-Security

Affected Vendors

Authcrunch

References (6)

Exploit https://blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-cadd...
Issue Tracking https://github.com/greenpau/caddy-security/issues/271
Third Party Advisory https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-6249864
Exploit https://blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-cadd...
Issue Tracking https://github.com/greenpau/caddy-security/issues/271
Third Party Advisory https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-6249864
20
/ 100
low-risk
Severity 15/34 · Moderate
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal