AVideo vulnerable to IP Address Spoofing via Untrusted HTTP Headers in getRealIpAddr()
概要
AVideo vulnerable to IP Address Spoofing via Untrusted HTTP Headers in getRealIpAddr()
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the getRealIpAddr() function in objects/functions.php trusts user-controlled HTTP headers to determine the client's IP address. An attacker can spoof their IP address by sending forged headers, bypassing any IP-based access controls or audit logging. Commit 1a1df6a9377e5cc67d1d0ac8ef571f7abbffbc6c contains a patch.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com