Lucene search

GoogleOSV:GO-2024-2565

HistoryJun 28, 2024 - 3:28 p.m.

Use of Insufficiently Random Values in github.com/greenpau/caddy-security

2024-06-2815:28:53

Google

osv.dev

insufficient random values

caddy security

github

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

6.8 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

15.7%

JSON

Use of Insufficiently Random Values in github.com/greenpau/caddy-security

References

blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-caddy

github.com/advisories/GHSA-c7vf-m394-m4x4

github.com/greenpau/caddy-security/issues/265

github.com/greenpau/go-authcrunch/commit/ecd3725baf2683eb1519bb3c81ae41085fbf7dc2

nvd.nist.gov/vuln/detail/CVE-2024-21495

security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-6248275

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

6.8 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

15.7%

JSON

Related for OSV:GO-2024-2565