CRITICAL🇬🇧 English

CVE-2018-21246

CVSS 9.8v3.1pub. 2020-06-15upd. 2024-11-21

Caddy before 0.10.13 mishandles TLS client authentication, as demonstrated by an authentication bypass caused by the lack of the StrictHostMatching mode.

oryginał EN
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Caddyserver Caddy

    APP
    Caddyserver
    < 0.10.3
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
Auth Bypass
CWE
Referencje

Powiązane podatności

CVE-2023-44487HIGH7.5⚠ KEVten sam produkt

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can ...

CVE-2026-52844HIGH7.5ten sam produkt

Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, on Windows, Caddy path match...

CVE-2026-45135HIGH8.1ten sam produkt

Caddy is an extensible server platform that uses TLS by default. From 2.7.0 until 2.11.3, the FastCGI transpor...

CVE-2026-52845HIGH8.1ten sam produkt

Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forward_auth copy_headers de...

CVE-2026-30851HIGH8.1ten sam produkt

Caddy is an extensible server platform that uses TLS by default. From version 2.10.0 to before version 2.11.2,...