A vulnerability was found in mod_wsgi. The X-Client-IP header is not removed from a request from an untrusted proxy, allowing an attacker to pass the X-Client-IP header to the target WSGI application because the condition to remove it is missing.
{ "nvd_published_at": "2022-08-25T18:15:00Z", "cwe_ids": [ "CWE-345" ], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2022-08-30T20:55:04Z" }