Skip to content
fr Sign in
6.1 Medium

CVE-2024-21496 All versions of the package github.com/greenpau/caddy-security are vulnerable to Cross-site Scripting (XSS) via the…

Description

All versions of the package github.com/greenpau/caddy-security are vulnerable to Cross-site Scripting (XSS) via the Referer header, due to improper input sanitization. Although the Referer header is sanitized by escaping some characters that can allow XSS (e.g., [&], [<], [>], ["], [']), it does not account for the attack based on the JavaScript URL scheme (e.g., javascript:alert(document.domain)// payload). Exploiting this vulnerability may not be trivial, but it could lead to the execution of malicious scripts in the context of the target user’s browser, compromising user sessions.

Affected products and versions

Product Affected versions Fixed in
github.com/greenpau/caddy-security Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of github.com/greenpau/caddy-security

The 9 CVEs of github.com/greenpau/caddy-security →
CVE-2024-21493 All versions of the package github.com/greenpau/caddy-security are vulnerable to Improper Validation of Array Index when… 5.3 Medium CVE-2024-21495 Versions of the package github.com/greenpau/caddy-security before 1.0.42 are vulnerable to Insecure Randomness due to… 6.5 Medium CVE-2024-21494 All versions of the package github.com/greenpau/caddy-security are vulnerable to Authentication Bypass by Spoofing via… 5.4 Medium CVE-2024-21500 All versions of the package github.com/greenpau/caddy-security are vulnerable to Improper Restriction of Excessive… 4.8 Medium
Track this CVE