Lucene search

MitreCVE-2024-44930

HistoryAug 29, 2024 - 6:15 p.m.

CVE-2024-44930

2024-08-2918:15:14

CWE-79

mitre

web.nvd.nist.gov

serilog

v2.1.0

client ip spoofing

vulnerability

http requests

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

AI Score

7.2

Confidence

High

EPSS

0.001

Percentile

17.7%

JSON

Serilog before v2.1.0 was discovered to contain a Client IP Spoofing vulnerability, which allows attackers to falsify their IP addresses by specifying an arbitrary IP as a value of X-Forwarded-For or Client-Ip headers while performing HTTP requests.

Affected configurations

Nvd

Node

serilog-contribserilog-enrichers-clientinfoRange<2.1.0

VendorProductVersionCPE
serilog-contribserilog-enrichers-clientinfo*cpe:2.3:a:serilog-contrib:serilog-enrichers-clientinfo:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
serilog-contrib	serilog-enrichers-clientinfo	*	cpe:2.3:a:serilog-contrib:serilog-enrichers-clientinfo::::::::

References

github.com/serilog-contrib/serilog-enrichers-clientinfo/issues/29

github.com/serilog-contrib/serilog-enrichers-clientinfo/releases/tag/v2.1.0

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

AI Score

7.2

Confidence

High

EPSS

0.001

Percentile

17.7%

JSON

Related for CVE-2024-44930