CVE-2024-21495mediumCWE-330

CVE-2024-21495: fallo de gravedad media en github.com/greenpau/caddy-security

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear github.com/greenpau/caddy-security+ Monitorear github.com/greenpau/caddy-security

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.5epss 0.7%
Versions of the package github.com/greenpau/caddy-security before 1.0.42 are vulnerable to Insecure Randomness due to using an insecure random number generation library which could possibly be predicted via a brute-force search. Attackers could use the potentially predictable nonce value used for authentication purposes in the OAuth flow to conduct OAuth replay attacks. In addition, insecure randomness is used while generating multifactor authentication (MFA) secrets and creating API keys in the database package.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:P
Productos afectados
n/a · github.com/greenpau/caddy-security