CVE search · CVE-2023-50463
CVE-2023-50463
medium 6.5
The caddy-geo-ip (aka GeoIP) middleware through 0.6.0 for Caddy 2, when trust_header X-Forwarded-For is used, allows attackers to spoof their source IP address via an X-Forwarded-For header, which may bypass a protection mechanism (trusted_proxy directive in reverse_proxy or IP address range restrictions).
Details
- Status
- Modified
- Published
- Last changed
- Source
- cve@mitre.org
- Weakness
- CWE-290
Severity
| Version | Score | Vector | Source |
|---|---|---|---|
| CVSS 3.1 | medium 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N |
nvd@nist.govPrimary |
Affected products
Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.
- caddyserver · caddy
References
- https://caddyserver.com/v2Broken Link
- https://github.com/shift72/caddy-geo-ip/issues/4Third Party Advisory
- https://github.com/shift72/caddy-geo-ip/tagsRelease Notes
- https://caddyserver.com/v2Broken Link
- https://github.com/shift72/caddy-geo-ip/issues/4Third Party Advisory
- https://github.com/shift72/caddy-geo-ip/tagsRelease Notes