CVE-2024-21494

CVE-2024-21494 affects all versions of the Go package github.com/greenpau/caddy-security, enabling authentication bypass through spoofing the X-Forwarded-For header due to improper input sanitization. An attacker can spoof an IP used in the user identity module’s /whoami endpoint, potentially gai...

CVE-2024-21495

The CVE-2024-21495 entry concerns the Go package github.com/greenpau/caddy-security (versions before 1.0.42). Root cause: insecure randomness used in multiple contexts (OAuth nonce, MFA secrets, API key generation) due to an insecure RNG library, enabling potential replay or predictability attack...

CVE-2024-21497

The CVE-2024-21497 entry corresponds to an Open Redirect in the Go package github.com/greenpau/caddy-security. Affected component: the Caddy security plugin’s redirect_url parameter; vulnerability type: Open Redirect leading to possible phishing by steering users to a malicious site. Trigger: an ...

CVE-2024-21493

The CVE-2024-21493 entry concerns the Go package github.com/greenpau/caddy-security, where multiple Caddyfile parsing functions fail to guard against nil input before indexing arrays. This Improper Validation of Array Index can cause panics during configuration parsing, potentially affecting web ...

CVE-2024-21499

The CVE-2024-21499 entry concerns the Go package github.com/greenpau/caddy-security. Affected component is the HTTP handling logic related to the X-Forwarded-Proto header, which enables HTTP header injection by redirecting to the injected protocol. Documented impact states that exploitation could...