~ / search / GHSA-vj36-3ccr-6563

GHSA-vj36-3ccr-6563

Authentication Bypass by Spoofing in github.com/greenpau/caddy-security

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-21494

Packages

EcosystemPackageAffectedFixed in
Go github.com/greenpau/caddy-security <= 1.1.23 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

All versions of the package github.com/greenpau/caddy-security are vulnerable to Authentication Bypass by Spoofing via the X-Forwarded-For header due to improper input sanitization. An attacker can spoof an IP address used in the user identity module (/whoami API endpoint). This could lead to unauthorized access if the system trusts this spoofed IP address.

References

External links from the advisory. They lead to third-party sites.