{"id":"CVE-2022-29718","aliases":["EUVD-2022-5889","GHSA-2927-hv3p-f3vp","openSUSE-SU-2022:10007-1","openSUSE-SU-2024:12132-1"],"status":"published","title":"Open redirect in caddy","description":"Caddy v2.4 was discovered to contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.01076,"percentile":0.65453,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-601"],"published":"2022-06-02T00:00:00Z","modified":"2026-10-28T02:30:52Z","fixes":[{"ecosystem":"Go","package":"github.com/caddyserver/caddy","fixed_in":["2.5.0"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/caddyserver/caddy/v2","fixed_in":["2.5.0"],"sources":["ghsa","osv"]},{"ecosystem":"SUSE:Package Hub 15 SP4","package":"caddy","fixed_in":["2.5.1-bp154.2.5.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"caddy","fixed_in":["2.5.1-bp154.2.5.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"caddy","fixed_in":["2.5.1-2.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/caddyserver/caddy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/caddyserver/caddy/v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/caddyserver/caddy","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.5.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/caddyserver/caddy/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.5.0"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP4","package":"caddy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-bp154.2.5.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"caddy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-bp154.2.5.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"caddy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-2.1"}]}]}],"products":[{"vendor":"caddyserver","product":"caddy"}],"references":[{"url":"https://github.com/caddyserver/caddy/pull/4499","tags":["x_transferred","Issue Tracking","Patch","Third Party Advisory","fix","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CP2VIUT5IKA3OKM6YWA5LTLJ2GTEIH7C/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29718","tags":["advisory"]},{"url":"https://github.com/caddyserver/caddy/pull/4499/commits/b23bdcf99cfbd09d50555a999a16468404789230","tags":["web"]},{"url":"https://github.com/caddyserver/caddy/releases/tag/v2.5.0","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CP2VIUT5IKA3OKM6YWA5LTLJ2GTEIH7C/"},{"url":"https://github.com/advisories/GHSA-2927-hv3p-f3vp"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29718.json","tags":["advisory"]},{"url":"https://github.com/caddyserver/caddy","tags":["package"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CP2VIUT5IKA3OKM6YWA5LTLJ2GTEIH7C","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ID6TRFNJC4CQHO4WTAHUQ4FGQUP3OZ7D/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1200279","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-29718","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-29718","description":"Caddy v2.4 was discovered to contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links.","status":"published","published":"2022-06-02T00:00:00Z","modified":"2024-08-03T06:33:42.417Z","updated_at":"2026-11-02T14:34:36.270817Z"}],"euvd":[{"id":"EUVD-2022-5889","description":"Caddy v2.4 was discovered to contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links.","status":"published","published":"2022-06-02T00:00:00Z","modified":"2024-08-03T06:33:42Z","updated_at":"2026-11-03T03:25:37.579336Z"}],"ghsa":[{"id":"GHSA-2927-hv3p-f3vp","title":"Open redirect in caddy","description":"Caddy v2.4 was discovered to contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links.","status":"published","published":"2022-06-03T00:00:29Z","modified":"2023-03-10T15:30:22Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:36:47.279442Z"}],"nvd":[{"id":"CVE-2022-29718","description":"Caddy v2.4 was discovered to contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links.","status":"published","published":"2022-06-02T21:15:07.933Z","modified":"2026-06-17T04:40:38.74Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:07:21.62951Z"}],"osv":[{"id":"GHSA-2927-hv3p-f3vp","title":"Open redirect in caddy","description":"Caddy v2.4 was discovered to contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links.","status":"published","published":"2022-06-03T00:00:29Z","modified":"2026-09-10T03:49:43.627683998Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T15:46:33.956911Z"},{"id":"CVE-2022-29718","description":"Caddy v2.4 was discovered to contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links.","status":"published","published":"2022-06-02T00:00:00Z","modified":"2026-10-28T02:30:52.429661414Z","updated_at":"2026-11-02T15:44:25.164673Z"},{"id":"openSUSE-SU-2022:10007-1","title":"Security update for caddy","description":"This update for caddy fixes the following issues:\n\nUpdate to version 2.5.1:\n\n* Fixed regression in Unix socket admin endpoints.\n* Fixed regression in caddy trust commands.\n* Hash-based load balancing policies (ip_hash, uri_hash, header, and cookie)\n  use an improved highest-random-weight (HRW) algorithm for increased\n  consistency.\n* Dynamic upstreams, which is the ability to get the list of upstreams at\n  every request (more specifically, every iteration in the proxy loop of\n  every request) rather than just once at config-load time.\n* Caddy will automatically try to get relevant certificates from the local\n  Tailscale instance.\n* New OpenTelemetry integration.\n* Added new endpoints /pki/ca/\u003cid\u003e and /pki/ca/\u003cid\u003e/certificates for\n  getting information about Caddy's managed CAs.\n* Rename _caddy to zsh-completion\n* Fix MatchPath sanitizing [bsc#1200279, CVE-2022-29718]\n","status":"published","published":"2022-06-10T18:01:10Z","modified":"2026-02-04T04:04:54.570685Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:12132-1","title":"caddy-2.5.1-2.1 on GA media","description":"These are all security issues fixed in the caddy-2.5.1-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:04:39.017579Z","updated_at":"2026-11-02T16:58:35.485255Z"}]}}