x/vulndb: potential Go vuln in github.com/greenpau/caddy-security: CVE-2024-21492

[GoVulnBot]

CVE-2024-21492 references [Path is unknown](https://Path is unknown), which may be a Go module.

Description:
All versions of the package github.com/greenpau/caddy-security are vulnerable to Insufficient Session Expiration due to improper user session invalidation upon clicking the "Sign Out" button. User sessions remain valid even after requests are sent to /logout and /oauth2/google/logout. Attackers who gain access to an active but supposedly logged-out session can perform unauthorized actions on behalf of the user.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2024-21492
• JSON: https://github.com/CVEProject/cvelist/tree/089b22bf0664d436ab15e62fe0e7a088182fd793/2024/21xxx/CVE-2024-21492.json
• web: https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-5920787
• web: https://blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-caddy/
• report: Lack of User Session Invalidation on Logout greenpau/caddy-security#272
• Imported by: https://pkg.go.dev/Path is unknown?tab=importedby

Cross references:
No existing reports found with this module or alias.

See doc/triage.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: Path is unknown
      packages:
        - package: github.com/greenpau/caddy-security
cves:
    - CVE-2024-21492
references:
    - web: https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-5920787
    - web: https://blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-caddy/
    - report: https://github.com/greenpau/caddy-security/issues/272

[gopherbot]

Change https://go.dev/cl/568036 mentions this issue: data/excluded: batch add 23 excluded reports

[gopherbot]

Change https://go.dev/cl/592778 mentions this issue: data/reports: unexclude 80 reports