Vulnerability Details CVE-2009-3287
lib/thin/connection.rb in Thin web server before 1.2.4 relies on the X-Forwarded-For header to determine the IP address of the client, which allows remote attackers to spoof the IP address and hide activities via a modified X-Forwarded-For header.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.005
EPSS Ranking 64.2%
CVSS Severity
CVSS v2 Score 7.5
References
- http://github.com/macournoyer/thin/blob/master/CHANGELOG
- http://github.com/macournoyer/thin/commit/7bd027914c5ffd36bb408ef47dc749de3b6e063a
- http://www.openwall.com/lists/oss-security/2009/09/12/1
- http://github.com/macournoyer/thin/blob/master/CHANGELOG
- http://github.com/macournoyer/thin/commit/7bd027914c5ffd36bb408ef47dc749de3b6e063a
- http://www.openwall.com/lists/oss-security/2009/09/12/1
Products affected by CVE-2009-3287
-
cpe:2.3:a:macournoyer:thin:*
-
cpe:2.3:a:macournoyer:thin:0.4.0
-
cpe:2.3:a:macournoyer:thin:0.4.1
-
cpe:2.3:a:macournoyer:thin:0.5.0
-
cpe:2.3:a:macournoyer:thin:0.5.1
-
cpe:2.3:a:macournoyer:thin:0.5.2
-
cpe:2.3:a:macournoyer:thin:0.5.3
-
cpe:2.3:a:macournoyer:thin:0.5.4
-
cpe:2.3:a:macournoyer:thin:0.6.0
-
cpe:2.3:a:macournoyer:thin:0.6.3
-
cpe:2.3:a:macournoyer:thin:0.6.4
-
cpe:2.3:a:macournoyer:thin:0.7.0
-
cpe:2.3:a:macournoyer:thin:0.7.1
-
cpe:2.3:a:macournoyer:thin:0.8.0
-
cpe:2.3:a:macournoyer:thin:0.8.1
-
cpe:2.3:a:macournoyer:thin:0.8.2
-
cpe:2.3:a:macournoyer:thin:1.0.0
-
cpe:2.3:a:macournoyer:thin:1.1.0
-
cpe:2.3:a:macournoyer:thin:1.1.1
-
cpe:2.3:a:macournoyer:thin:1.2.0
-
cpe:2.3:a:macournoyer:thin:1.2.1