Skip to content
OpenAdvisories
Medium · 5.4 CVE-2023-52430 EUVD-2024-0774GHSA-xwmv-cx7p-fqfcGO-2024-2549

caddy-security plugin for Caddy vulnerable to reflected Cross-site Scripting

Published Feb 12, 2024 · Updated May 6, 2025 · Assigned by mitre

Package: github.com/greenpau/caddy-security Ecosystem: Go

Description

The caddy-security plugin 1.1.20 for Caddy allows reflected XSS via a GET request to a URL that contains an XSS payload and begins with either a /admin or /settings/mfa/delete/ substring.

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/greenpau/caddy-security <= 1.1.20 — GHSA-xwmv-cx7p-fqfc
Go github.com/greenpau/caddy-security all versions — GO-2024-2549

References