CVE-2024-21498CWE-918

All versions of the package github.com/greenpau/caddy-security are vulnerable to Server-side Request Forgery (SSRF) via X-Forwarded-Host header manipulation

Medium · published February 17, 2024

CVSS v3.1
5.3
EPSS
1%
Percentile
45.5
In the wild
Unconfirmed
What it is

All versions of the package github.com/greenpau/caddy-security are vulnerable to Server-side Request Forgery (SSRF) via X-Forwarded-Host header manipulation. An attacker can expose sensitive information, interact with internal services, or exploit other vulnerabilities within the network by exploiting this vulnerability.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P
CVSS v4.0
Not supplied
EPSS
0.00554 · 45.5th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2024-02-17T05:00Z
EPSS history
Timeline
  • 17 FEB 05:00Z
    All versions of the package github.com/greenpau/caddy-security are vulnerable to Server-side Request Forgery (SSRF) via X-Forwarded-Host header manipulation
    cvelistv5