CVE-2022-28923

MEDIUMNuclei

Open Redirect in Caddy

Title source: GitHub Advisory
STIX 2.1 vulnerability

Record summary

CVE-2022-28923 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

Caddy v2.4.6 was discovered to contain an open redirection vulnerability which allows attackers to redirect users to phishing websites via crafted URLs.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 26, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

github.com/caddyserver/caddy/v2

Browse Go / github.com/caddyserver/caddy/v2
GitHub AdvisoryBefore 2.5.0-beta.1 · Fixed in 2.5.0-beta.1affected

Nuclei templates

1
ProjectDiscoveryMEDIUMCaddy 2.4.6 - Open RedirectCVSS 6.1

Caddy 2.4.6 contains an open redirect vulnerability. An attacker can redirect a user to a malicious site via a crafted URL and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.

Impact

Successful exploitation of this vulnerability could lead to phishing attacks, credential theft,.

Remediation

Upgrade Caddy to version 2.4.7 or later to mitigate the vulnerability.

WeaknessesCWE-601
AuthorsSascha Brendel, DhiyaneshDk
Template tagscvecve2022redirectcaddywebservercaddyservervuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:caddyserver:caddy:2.4.6:*:*:*:*:*:*:*
Shodan: Server: caddy
Shodan: server: caddy
https://lednerb.de/en/publications/responsible-disclosure/caddy-open-redirect-vulnerability/ https://www.cve.org/CVERecord?id=CVE-2022-28923 https://github.com/caddyserver/caddy/issues/4502 https://nvd.nist.gov/vuln/detail/CVE-2022-28923 https://github.com/ARPSyndicate/cvemon

Source: ProjectDiscovery

References

5