Cross-site Scripting (XSS)

2024-02-1911:58:23

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

github

greenpau

caddy

xss

referer

input sanitization

javascript url scheme

vulnerability

header

security

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

5.4

Confidence

High

EPSS

Percentile

15.5%

JSON

github.com/greenpau/caddy-security is vulnerable to Cross-site Scripting (XSS) via the Referer header. The vulnerability is due to improper input sanitization. Although the Referer header is sanitized by escaping some characters that can allow XSS (e.g., [&], [<], [>], ["], [']), it does not account for an attack based on the JavaScript URL scheme.