CVE-2023-44463

MEDIUM5.3EPSS 0.16%

pretix potential IP address spoofing vulnerability

發布日:2023/10/2修改日:2024/10/21

描述

An issue was discovered in pretix before 2023.7.1. Incorrect parsing of configuration files causes the application to trust unchecked X-Forwarded-For headers even though it has not been configured to do so. This can lead to IP address spoofing by users of the application.

受影響套件(2)

  • PyPI/pretixfrom 0, < 2023.7.1
  • PyPI/pretixfrom 0, < ccdce2ccb8207b82501af3c03f50abc0f819b469 | from 0, < 2023.7.1

CVSS 分數

來源版本嚴重程度向量
osvCVSS 4.0—CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
osvCVSS 3.1MEDIUM5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

參考連結(9)