CVE-2020-28483

HIGH7.1EPSS 0.36%

Inconsistent interpretation of HTTP Requests in github.com/gin-gonic/gin

發布日:2021/6/23修改日:2026/4/28

也稱為:DEBIAN-CVE-2020-28483

描述

This affects all versions of package github.com/gin-gonic/gin. When gin is exposed directly to the internet, a client's IP can be spoofed by setting the X-Forwarded-For header.

受影響套件(3)

Debian/golang-github-gin-gonic-ginfrom 0
Go/github.com/gin-gonic/ginfrom 0, < 1.7.7
Go/github.com/gin-gonic/ginfrom 0, < 1.7.7

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	HIGH7.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

參考連結(19)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2020-28483
ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2020-28483
PATCHhttps://github.com/gin-gonic/gin
WEBhttps://github.com/gin-gonic/gin/commit/03e5e05ae089bc989f1ca41841f05504d29e3fd9
WEBhttps://github.com/gin-gonic/gin/commit/5929d521715610c9dd14898ebbe1d188d5de8937
WEBhttps://github.com/gin-gonic/gin/commit/bfc8ca285eb46dad60e037d57c545cd260636711
WEBhttps://github.com/gin-gonic/gin/issues/2232
WEBhttps://github.com/gin-gonic/gin/issues/2473
WEBhttps://github.com/gin-gonic/gin/issues/2862
WEBhttps://github.com/gin-gonic/gin/pull/2474
WEBhttps://github.com/gin-gonic/gin/pull/2474#23issuecomment-729696437
WEBhttps://github.com/gin-gonic/gin/pull/2632
WEBhttps://github.com/gin-gonic/gin/pull/2675
WEBhttps://github.com/gin-gonic/gin/pull/2844
WEBhttps://github.com/gin-gonic/gin/pull/2844/files#diff-e6ce689a25eaef174c2dd51fe869fabbe04a6c6afbd416b23eda138c82e761baR1432
WEBhttps://github.com/gin-gonic/gin/releases/tag/v1.7.0
WEBhttps://github.com/gin-gonic/gin/releases/tag/v1.7.7
WEBhttps://pkg.go.dev/vuln/GO-2021-0052
WEBhttps://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGINGONICGIN-1041736