CVE-2018-21246

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Caddy before 0.10.13 mishandles TLS client authentication, as demonstrated by an authentication bypass caused by the lack of the StrictHostMatching mode.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published
Jun 15, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-212477.5An issue was discovered in LibVNCServer before 0.9.13. There is an information leak (of uninitialized memory contents) in the libvncclient/rCVE-2018-212487.5An issue was discovered in Mattermost Server before 5.4.0. It mishandles possession of superfluous authentication credentials.CVE-2018-212493.7An issue was discovered in Mattermost Server before 5.3.0. It mishandles timing.CVE-2018-212506.5An issue was discovered in Mattermost Server before 5.2.2, 5.1.2, and 4.10.4. It allows remote attackers to cause a denial of service (memorCVE-2018-212519.8An issue was discovered in Mattermost Server before 5.2 and 5.1.1. Authorization could be bypassed if the channel name were not the same in CVE-2018-212524.3An issue was discovered in Mattermost Server before 5.2, 5.1.1, 5.0.3, and 4.10.3. Attackers could use multiple e-mail addresses to bypass aCVE-2018-212534.3An issue was discovered in Mattermost Server before 5.1, 5.0.2, and 4.10.2. An attacker could use the invite_people slash command to invite CVE-2018-212544.3An issue was discovered in Mattermost Server before 5.1. An attacker can bypass intended access control (for direct-message channel creationCVE-2018-212554.3An issue was discovered in Mattermost Server before 5.1. Non-members of a channel could use the Channel PATCH API to modify that channel.CVE-2018-212564.3An issue was discovered in Mattermost Server before 5.1. It allows attackers to bypass intended access restrictions (for group-message channCVE-2018-212575.3An issue was discovered in Mattermost Server before 5.1. It allows attackers to bypass intended access restrictions (for setting a channel hCVE-2018-212587.5An issue was discovered in Mattermost Server before 5.1. It allows attackers to cause a denial of service via the invite_people slash comman
CVE-2018-21246: Critical severity, CVSS 9.8 | Vulnix