CVE-2023-52430

Summary

The caddy-security plugin 1.1.20 for Caddy allows reflected XSS via a GET request to a URL that contains an XSS payload and begins with either a /admin or /settings/mfa/delete/ substring.

Affected Software

Weaknesses

• n/a

ADP Enrichment

CVE Program Container

Additional References

• https://blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-caddy/
• https://github.com/greenpau/caddy-security/issues/264

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: partial

References

• https://blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-caddy/
• https://github.com/greenpau/caddy-security/issues/264

• ←Previous
• Next→