GHSA-82x2-g7vr-39wq

Source

https://github.com/advisories/GHSA-82x2-g7vr-39wq

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/08/GHSA-82x2-g7vr-39wq/GHSA-82x2-g7vr-39wq.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-82x2-g7vr-39wq

Withdrawn

2020-06-17T15:14:38Z

Published

2018-08-13T20:48:09Z

Modified

2024-12-02T05:46:55Z

Summary

Moderate severity vulnerability that affects web-console

Details

Withdrawn, accidental duplicate publish.

request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to bypass the whitelisted_ips protection mechanism via a crafted request.

Database specific

{
    "cwe_ids":  [],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-06-17T15:14:38Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}

References

Affected packages

RubyGems / web-console

Package

Name: web-console
Purl: pkg:gem/web-console

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.1.3

Affected versions

0.*

0.1.0

0.2.0

0.3.0

0.4.0

1.*

1.0.0

1.0.1

1.0.2

1.0.3

1.0.4

2.*

2.0.0.beta1

2.0.0.beta2

2.0.0.beta3

2.0.0.beta4

2.0.0

2.1.0

2.1.1

2.1.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/08/GHSA-82x2-g7vr-39wq/GHSA-82x2-g7vr-39wq.json"