medium6.1
CVE-2023-52430
caddy-security plugin for Caddy vulnerable to reflected Cross-site Scripting
Impact
The caddy-security plugin 1.1.20 for Caddy allows reflected XSS via a GET request to a URL that contains an XSS payload and begins with either a /admin or /settings/mfa/delete/ substring.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/greenpau/caddy-security | <= 1.1.20 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Authcrunch | Caddy-Security | Version 1.1.20 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-caddy/
- https://github.com/greenpau/caddy-security/issues/264
- https://github.com/advisories/GHSA-xwmv-cx7p-fqfc
- https://nvd.nist.gov/vuln/detail/CVE-2023-52430
- https://blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-caddy