Lucene search

K
osvGoogleOSV:GHSA-8H95-JCP5-PJPR
HistoryFeb 17, 2024 - 6:30 a.m.

Improper Validation of Array Index in github.com/greenpau/caddy-security

2024-02-1706:30:34
Google
osv.dev
3
github
caddy-security
array index
validation
vulnerability
parsing
configuration
web server

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

7.1 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.7%

All versions of the package github.com/greenpau/caddy-security are vulnerable to Improper Validation of Array Index when parsing a Caddyfile. Multiple parsing functions in the affected library do not validate whether their input values are nil before attempting to access elements, which can lead to a panic (index out of range). Panics during the parsing of a configuration file may introduce ambiguity and vulnerabilities, hindering the correct interpretation and configuration of the web server.

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

7.1 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.7%

Related for OSV:GHSA-8H95-JCP5-PJPR