CVE-2024-21498 MEDIUM

CVE-2024-21498

Vendor N/A
Product github.com/greenpau/caddy-security
Weakness CWE-918 · SSRF
Published February 17, 2024
Last update August 1, 2024
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P

What the vulnerability does

01Description

All versions of the package github.com/greenpau/caddy-security are vulnerable to Server-side Request Forgery (SSRF) via X-Forwarded-Host header manipulation. An attacker can expose sensitive information, interact with internal services, or exploit other vulnerabilities within the network by exploiting this vulnerability.

Key dates

02Disclosure timeline

February 17, 2024 CVE published
August 1, 2024 Record updated