CVE-2024-21500: All versions of the package github.com/greenpau/caddy-security are vulnerable to Improper Restriction of Excessive Authentication Attempts via the...
4.8
CVSS
Description
All versions of the package github.com/greenpau/caddy-security are vulnerable to Improper Restriction of Excessive Authentication Attempts via the two-factor authentication (2FA). Although the application blocks the user after several failed attempts to provide 2FA codes, attackers can bypass this blocking mechanism by automating the application’s full multistep 2FA process.
Classification
CVE ID: CVE-2024-21500
CVSS Base Severity: MEDIUM
CVSS Base Score: 4.8
Affected Products
Vendor: n/a
Product: github.com/greenpau/caddy-security
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.05% (probability of being exploited)
EPSS Percentile: 17.81% (scored less or equal to compared to others)
EPSS Date: 2025-02-03 (when was this score calculated)
References
https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-6249864https://github.com/greenpau/caddy-security/issues/271
https://blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-caddy/