CVE-2022-28923: Medium severity caddyserver Caddy vulnerability
Caddy v2.4.6 was discovered to contain an open redirection vulnerability which allows attackers to redirect users to phishing websites via crafted URLs
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/caddyserver/caddy/v2to a version that resolves this vulnerability.Fixed in 2.5.0-beta.1 - Upgrade
Upgrade
debian/caddyto a version that resolves this vulnerability.Fixed in 2.6.2-5Fixed in 2.6.2-5+deb12u1Fixed in 2.6.2-12+deb13u1Fixed in 2.11.4-1 - Upgrade
Upgrade
debian/caddyto a version that resolves this vulnerability.Fixed in 2.5.2-1
Event History
Frequently Asked Questions
What is CVE-2022-28923?
CVE-2022-28923 is an open redirection vulnerability in Caddy v2.4.6.
How does CVE-2022-28923 affect Caddy?
CVE-2022-28923 allows attackers to redirect users to phishing websites via crafted URLs in Caddy v2.4.6.
What is the severity of CVE-2022-28923?
CVE-2022-28923 has a severity rating of medium (6.1).
How can I fix CVE-2022-28923?
To fix CVE-2022-28923, update Caddy to a version higher than 2.4.6.
Where can I find more information about CVE-2022-28923?
More information about CVE-2022-28923 can be found at https://lednerb.de/en/publications/responsible-disclosure/caddy-open-redirect-vulnerability/.