Lucene search

K
githubGitHub Advisory DatabaseGHSA-8HP3-RMR7-XH88
HistoryFeb 17, 2024 - 6:30 a.m.

Open Redirect in github.com/greenpau/caddy-security

2024-02-1706:30:35
CWE-601
GitHub Advisory Database
github.com
6
github.com/greenpau/caddy-security
open redirect
phishing
vulnerability
exploit
user action
browser

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

6.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.7%

All versions of the package github.com/greenpau/caddy-security are vulnerable to Open Redirect via the redirect_url parameter. An attacker could perform a phishing attack and trick users into visiting a malicious website by crafting a convincing URL with this parameter. To exploit this vulnerability, the user must take an action, such as clicking on a portal button or using the browser’s back button, to trigger the redirection.

Affected configurations

Vulners
Node
github.com\/greenpau\/caddysecurityRange≀1.1.23

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

6.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.7%

Related for GHSA-8HP3-RMR7-XH88