CVE-2024-21493 json
Improper Validation of Array Index in github.com/greenpau/caddy-security
published 2024-02-17 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-0575 , GHSA-8h95-jcp5-pjpr , GO-2024-2564
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 54%
- public exploits
- 0
- none known
Summary
All versions of the package github.com/greenpau/caddy-security are vulnerable to Improper Validation of Array Index when parsing a Caddyfile. Multiple parsing functions in the affected library do not validate whether their input values are nil before attempting to access elements, which can lead to a panic (index out of range). Panics during the parsing of a configuration file may introduce ambiguity and vulnerabilities, hindering the correct interpretation and configuration of the web server.
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.72% chance of exploitation in the next 30 days, higher than 54% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
| NVD | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/greenpau/caddy-security | <=1.1.23 all versions |
no fix listed |
Affected products
- n/a github.com/greenpau/caddy-security
Classification
- Weakness
-
- CWE-129 Improper Validation of Array Index
References
-
security.snyk.io
/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-5961078
web, third-party-advisory
-
blog.trailofbits.com
/2023/09/18/security-flaws-in-an-sso-plugin-for-caddy/
third-party-advisory
-
github.com
/greenpau/caddy-security/issues/263
web, issue-tracking, report
-
nvd.nist.gov
/vuln/detail/CVE-2024-21493
advisory
-
blog.trailofbits.com
/2023/09/18/security-flaws-in-an-sso-plugin-for-caddy
web
-
github.com
/advisories/GHSA-8h95-jcp5-pjpr
advisory
Sources
- CVE List CVE-2024-21493
- GitHub Advisory GHSA-8h95-jcp5-pjpr
- NVD CVE-2024-21493
- OSV GO-2024-2564
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.