CVE-2024-21496
CVSS V2 None
CVSS V3 None
Description
All versions of the package github.com/greenpau/caddy-security are vulnerable to Cross-site Scripting (XSS) via the Referer header, due to improper input sanitization. Although the Referer header is sanitized by escaping some characters that can allow XSS (e.g., [&], [<], [>], ["], [']), it does not account for the attack based on the JavaScript URL scheme (e.g., javascript:alert(document.domain)// payload). Exploiting this vulnerability may not be trivial, but it could lead to the execution of malicious scripts in the context of the target user’s browser, compromising user sessions.
Overview
- CVE ID
- CVE-2024-21496
- Assigner
- snyk
- Vulnerability Status
- PUBLISHED
- Published Version
- 2024-02-17T05:00:02.407Z
- Last Modified Date
- 2024-03-06T14:09:46.106Z
Weakness Enumerations
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2024-21496 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21496 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2024-06-26 15:12:12 | Added to TrackCVE |