caddyserver/caddy · Security
Open Redirect in Caddy
- GHSA ID
- GHSA-qpm3-vr34-h8w8
- CVE ID
- CVE-2022-28923
- Severity
- medium
- Published
- Updated
- CVSS
- 6.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CVSS v3
- 6.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Description
Caddy v2.4.6 was discovered to contain an open redirection vulnerability which allows attackers to redirect users to phishing websites via crafted URLs
CWEs
- CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
References
- https://nvd.nist.gov/vuln/detail/CVE-2022-28923 ↗
- https://github.com/caddyserver/caddy/commit/78b5356f2b1945a90de1ef7f2c7669d82098edbd ↗
- https://pkg.go.dev/vuln/GO-2023-1567 ↗
- https://lednerb.de/en/publications/responsible-disclosure/caddy-open-redirect-vulnerability ↗
- https://github.com/advisories/GHSA-qpm3-vr34-h8w8 ↗