CVE-2024-21499

🗓️ 17 Feb 2024 05:00:06Reported by snykType

cve🔗 web.nvd.nist.gov👁 107 Views🌐 WEB

All versions of github.com/greenpau/caddy-security are vulnerable to HTTP Header Injection via X-Forwarded-Proto, leading to bypass of security mechanisms or confusion in TLS handling

Reporter	Title	Published	Views	Family All 17
Circl	CVE-2024-21499	17 Feb 202406:21	–	circl
CNNVD	caddy-security Security Vulnerabilities	17 Feb 202400:00	–	cnnvd
Cvelist	CVE-2024-21499	17 Feb 202405:00	–	cvelist
EUVD	EUVD-2024-0712	3 Oct 202520:07	–	euvd
Github Security Blog	Improper Neutralization of HTTP Headers in github.com/greenpau/caddy-security	17 Feb 202406:30	–	github
Mend	CVE-2024-21499	17 Feb 202405:00	–	mend
NVD	CVE-2024-21499	17 Feb 202405:15	–	nvd
osv_cve	CVE-2024-21499	17 Feb 202405:15	–	osv_cve
osv_ghsa	GHSA-R969-783F-6JQR Improper Neutralization of HTTP Headers in github.com/greenpau/caddy-security	17 Feb 202406:30	–	osv_ghsa
osv_go	GO-2024-2562 Improper Neutralization of HTTP Headers in github.com/greenpau/caddy-security	28 Jun 202415:28	–	osv_go

NVD

Vulners

Node

greenpau caddy-security

[
  {
    "product": "github.com/greenpau/caddy-security",
    "versions": [
      {
        "version": "0",
        "lessThan": "*",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "vendor": "n/a"
  }
]

Source	Link
blog	www.blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-caddy/
security	www.security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-6249863
github	www.github.com/greenpau/caddy-security/issues/270

Parameter	Position	Path	Description	CWE
X-Forwarded-Proto	header	/	HTTP Header Injection via the X-Forwarded-Proto header, allowing an attacker to inject a protocol that causes the server to redirect to an insecure or unintended protocol.	CWE-116, CWE-644

17 Jun 2026 07:09Current

4.9Medium risk

Vulners AI Score4.9

CVSS 3.14.3

EPSS0.00495

SSVC