GHSA-qpm3-vr34-h8w8

Open Redirect in Caddy

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-28923

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/caddyserver/caddy/v2	< 2.5.0-beta.1	2.5.0-beta.1

Details

As written in the advisory (Markdown source, shown as plain text).

Caddy v2.4.6 was discovered to contain an open redirection vulnerability which allows attackers to redirect users to phishing websites via crafted URLs

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-28923 advisory
https://github.com/caddyserver/caddy/commit/78b5356f2b1945a90de1ef7f2c7669d82098edbd web
https://github.com/caddyserver/caddy package
https://lednerb.de/en/publications/responsible-disclosure/caddy-open-redirect-vulnerability web
https://pkg.go.dev/vuln/GO-2023-1567 web