caddy-security plugin for Caddy vulnerable to reflected Cross-site Scripting

Description

References

• nvd.nist.gov/vuln/detail/CVE-2023-52430 · ADVISORY
• greenpau/caddy-security · WEB
• blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-caddy · WEB
• greenpau/caddy-security · PACKAGE
• blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-caddy · Third Party Advisory
• GitHub Advisory GHSA-xwmv-cx7p-fqfc · ADVISORY

More vulnerabilities in github.com/greenpau/caddy-security

• CVE-2024-21500MEDIUM 6.5All versions of the package github.com/greenpau/caddy-security are vulnerable to Improper Restriction of Excessive Authentication Attempts v…
• CVE-2024-21499MEDIUM 4.3All versions of the package github.com/greenpau/caddy-security are vulnerable to HTTP Header Injection via the X-Forwarded-Proto header due …
• CVE-2024-21498MEDIUM 5.3All versions of the package github.com/greenpau/caddy-security are vulnerable to Server-side Request Forgery (SSRF) via X-Forwarded-Host hea…
• CVE-2024-21497MEDIUM 6.1Versions of the package github.com/greenpau/caddy-security are vulnerable to Open Redirect via the redirect_url parameter. An attacker coul…
• CVE-2024-21496MEDIUM 6.1All versions of the package github.com/greenpau/caddy-security are vulnerable to Cross-site Scripting (XSS) via the Referer header, due to i…