CVE-2023-52430

Name of the Vulnerable Software and Affected Versions caddy-security plugin for Caddy version 1.1.20

Description The issue allows reflected Cross-site Scripting (XSS) via a GET request to a URL that contains an XSS payload and begins with either a "/admin" or "/settings/mfa/delete/" substring. This can be exploited by sending a malicious GET request to the vulnerable URL.

Recommendations For version 1.1.20, consider disabling access to the "/admin" and "/settings/mfa/delete/" API endpoints until a patch is available. Restrict the use of the caddy-security plugin to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.