CVE-2022-29718: Open redirect in caddy

June 2, 2022 (updated November 9, 2023)

Caddy v2.4 was discovered to contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links.

References

github.com/advisories/GHSA-2927-hv3p-f3vp
github.com/caddyserver/caddy/pull/4499
github.com/caddyserver/caddy/pull/4499/commits/b23bdcf99cfbd09d50555a999a16468404789230
github.com/caddyserver/caddy/releases/tag/v2.5.0
nvd.nist.gov/vuln/detail/CVE-2022-29718

Code Behaviors & Features

Detect and mitigate CVE-2022-29718 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →