CVE-2024-21494

🗓️ 17 Feb 2024 05:00:07Reported by snykType

cve🔗 web.nvd.nist.gov👁 109 Views🌐 WEB

All versions of github.com/greenpau/caddy-security are vulnerable to Authentication Bypass by Spoofing via X-Forwarded-For header

Reporter	Title	Published	Views	Family All 14
Circl	CVE-2024-21494	17 Feb 202406:21	–	circl
CNNVD	Caddy Security Breach	17 Feb 202400:00	–	cnnvd
Cvelist	CVE-2024-21494	17 Feb 202405:00	–	cvelist
EUVD	EUVD-2024-0735	3 Oct 202520:07	–	euvd
Github Security Blog	Authentication Bypass by Spoofing in github.com/greenpau/caddy-security	17 Feb 202406:30	–	github
NVD	CVE-2024-21494	17 Feb 202405:15	–	nvd
OSV	CVE-2024-21494	17 Feb 202405:15	–	osv
OSV	GHSA-VJ36-3CCR-6563 Authentication Bypass by Spoofing in github.com/greenpau/caddy-security	17 Feb 202406:30	–	osv
OSV	GO-2024-2558 Authentication Bypass by Spoofing in github.com/greenpau/caddy-security	28 Jun 202415:28	–	osv
Prion	Authentication flaw	17 Feb 202405:15	–	prion

NVD

Node

greenpau caddy-security

[
  {
    "product": "github.com/greenpau/caddy-security",
    "versions": [
      {
        "version": "0",
        "lessThan": "*",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "vendor": "n/a"
  }
]

Source	Link
blog	www.blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-caddy/
github	www.github.com/greenpau/caddy-security/issues/266
security	www.security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-6249859

Parameter	Position	Path	Description	CWE
X-Forwarded-For	header	/whoami	Authentication bypass by spoofing X-Forwarded-For header to impersonate user identity via the /whoami endpoint.	CWE-290, CWE-79

24 Apr 2025 15:15Current

5.3Medium risk

Vulners AI Score5.3

CVSS 3.15.4

EPSS0.00027

SSVC