Sign-up

ID

VAR-202206-0033


CVE

CVE-2022-29718


TITLE

Light Code Labs  of  Caddy  Open redirect vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2022-010733

DESCRIPTION

Caddy v2.4 was discovered to contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links. Light Code Labs of Caddy Exists in an open redirect vulnerability.Information may be obtained and information may be tampered with

Trust: 1.71

sources: NVD: CVE-2022-29718 // JVNDB: JVNDB-2022-010733 // VULMON: CVE-2022-29718

AFFECTED PRODUCTS

vendor:caddyservermodel:caddyscope:gteversion:2.4.0

Trust: 1.0

vendor:caddyservermodel:caddyscope:ltversion:2.5.0

Trust: 1.0

vendor:light codemodel:caddyscope: - version: -

Trust: 0.8

vendor:light codemodel:caddyscope:eqversion:2.4.0 that's all 2.5.0

Trust: 0.8

vendor:light codemodel:caddyscope:eqversion: -

Trust: 0.8

sources: JVNDB: JVNDB-2022-010733 // NVD: CVE-2022-29718

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2022-29718
value: MEDIUM

Trust: 1.0

NVD: CVE-2022-29718
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-202206-409
value: MEDIUM

Trust: 0.6

VULMON: CVE-2022-29718
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2022-29718
severity: MEDIUM
baseScore: 5.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

nvd@nist.gov: CVE-2022-29718
baseSeverity: MEDIUM
baseScore: 6.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 2.8
impactScore: 2.7
version: 3.1

Trust: 1.0

NVD: CVE-2022-29718
baseSeverity: MEDIUM
baseScore: 6.1
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULMON: CVE-2022-29718 // JVNDB: JVNDB-2022-010733 // CNNVD: CNNVD-202206-409 // NVD: CVE-2022-29718

PROBLEMTYPE DATA

problemtype:CWE-601

Trust: 1.0

problemtype:Open redirect (CWE-601) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2022-010733 // NVD: CVE-2022-29718

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202206-409

TYPE

input validation error

Trust: 0.6

sources: CNNVD: CNNVD-202206-409

PATCH

title:Caddy Enter the fix for the verification error vulnerabilityurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=195761

Trust: 0.6

sources: CNNVD: CNNVD-202206-409

EXTERNAL IDS

db:NVDid:CVE-2022-29718

Trust: 3.3

db:JVNDBid:JVNDB-2022-010733

Trust: 0.8

db:CNNVDid:CNNVD-202206-409

Trust: 0.6

db:VULMONid:CVE-2022-29718

Trust: 0.1

sources: VULMON: CVE-2022-29718 // JVNDB: JVNDB-2022-010733 // CNNVD: CNNVD-202206-409 // NVD: CVE-2022-29718

REFERENCES

url:https://github.com/caddyserver/caddy/pull/4499

Trust: 2.5

url:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/cp2viut5ika3okm6ywa5ltlj2gteih7c/

Trust: 1.4

url:https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/cp2viut5ika3okm6ywa5ltlj2gteih7c/

Trust: 1.0

url:https://nvd.nist.gov/vuln/detail/cve-2022-29718

Trust: 0.8

url:https://vigilance.fr/vulnerability/caddy-open-redirect-38608

Trust: 0.6

url:https://cxsecurity.com/cveshow/cve-2022-29718/

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/601.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: VULMON: CVE-2022-29718 // JVNDB: JVNDB-2022-010733 // CNNVD: CNNVD-202206-409 // NVD: CVE-2022-29718

SOURCES

db:VULMONid:CVE-2022-29718
db:JVNDBid:JVNDB-2022-010733
db:CNNVDid:CNNVD-202206-409
db:NVDid:CVE-2022-29718

LAST UPDATE DATE

2024-11-23T22:40:27.653000+00:00


SOURCES UPDATE DATE

db:VULMONid:CVE-2022-29718date:2022-06-12T00:00:00
db:JVNDBid:JVNDB-2022-010733date:2023-08-16T08:15:00
db:CNNVDid:CNNVD-202206-409date:2023-03-13T00:00:00
db:NVDid:CVE-2022-29718date:2024-11-21T06:59:36.110

SOURCES RELEASE DATE

db:VULMONid:CVE-2022-29718date:2022-06-02T00:00:00
db:JVNDBid:JVNDB-2022-010733date:2023-08-16T00:00:00
db:CNNVDid:CNNVD-202206-409date:2022-06-02T00:00:00
db:NVDid:CVE-2022-29718date:2022-06-02T21:15:07.933