Lucene search

K
githubGitHub Advisory DatabaseGHSA-8H95-JCP5-PJPR
HistoryFeb 17, 2024 - 6:30 a.m.

Improper Validation of Array Index in github.com/greenpau/caddy-security

2024-02-1706:30:34
CWE-129
GitHub Advisory Database
github.com
5
caddy security
array index
vulnerability
configuration parsing
web server
panics

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

6.8 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.7%

All versions of the package github.com/greenpau/caddy-security are vulnerable to Improper Validation of Array Index when parsing a Caddyfile. Multiple parsing functions in the affected library do not validate whether their input values are nil before attempting to access elements, which can lead to a panic (index out of range). Panics during the parsing of a configuration file may introduce ambiguity and vulnerabilities, hindering the correct interpretation and configuration of the web server.

Affected configurations

Vulners
Node
github.com\/greenpau\/caddysecurityRange1.1.23

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

6.8 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.7%

Related for GHSA-8H95-JCP5-PJPR