PT-2022-19796 · Caddy+1 · Caddy+1

Govulnbot · Published 2022-05-12 · Updated 2024-06-15 · CVE-2022-29718

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Caddy version v2.4

Description A remote unauthenticated attacker may exploit this issue to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links. The issue is an open redirect vulnerability.

Recommendations For Caddy version v2.4, as a temporary workaround, consider restricting access to potentially vulnerable endpoints until a patch is available. Avoid using crafted links that may redirect users to arbitrary web URLs. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

ALT-PU-2022-1850

CVE-2022-29718

GHSA-2927-HV3P-F3VP

OPENSUSE-SU-2022:10007-1

OPENSUSE-SU-2024:12132-1

Affected Products

Alt Linux

Caddy

References · 17

• https://github.com/caddyserver/caddy/pull/4499 · Patch
• https://osv.dev/vulnerability/CVE-2022-29718 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2022:10007-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29718 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CP2VIUT5IKA3OKM6YWA5LTLJ2GTEIH7C · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2927-hv3p-f3vp · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/CP2VIUT5IKA3OKM6YWA5LTLJ2GTEIH7C · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12132-1 · Vendor Advisory
• https://github.com/caddyserver/caddy · Note
• https://github.com/caddyserver/caddy/releases/tag/v2.5.0 · Note
• https://github.com/caddyserver/caddy/pull/4499/commits/b23bdcf99cfbd09d50555a999a16468404789230 · Note
• https://t.me/cvenotify/45924 · Telegram Post
• https://suse.com/security/cve/CVE-2022-29718 · Note
• https://lists.opensuse.org/archives/list/[e-mail]/thread/ID6TRFNJC4CQHO4WTAHUQ4FGQUP3OZ7D · Note
• https://t.me/cibsecurity/43779 · Telegram Post