CVE-2023-52430

2024-02-1223:15:08

[email protected]

web.nvd.nist.gov

caddy

security

reflected xss

get request

5.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.2%

JSON

The caddy-security plugin 1.1.20 for Caddy allows reflected XSS via a GET request to a URL that contains an XSS payload and begins with either a /admin or /settings/mfa/delete/ substring.

References

blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-caddy/

github.com/greenpau/caddy-security/issues/264