High severity vulnerability that affects thin

2017-10-2418:33:38

Google

osv.dev

0.005 Low

EPSS

Percentile

75.6%

JSON

lib/thin/connection.rb in Thin web server before 1.2.4 relies on the X-Forwarded-For header to determine the IP address of the client, which allows remote attackers to spoof the IP address and hide activities via a modified X-Forwarded-For header.

CPENameOperatorVersion
thineq0.6.4
thineq0.6.0
thineq0.6.2
thineq0.8.0
thineq0.6.1
thineq0.4.0
thineq1.2.2
thineq1.0.0
thineq0.5.2
thineq0.3.0

Name	Operator	Version
thin	eq	0.6.4
thin	eq	0.6.0
thin	eq	0.6.2
thin	eq	0.8.0
thin	eq	0.6.1
thin	eq	0.4.0
thin	eq	1.2.2
thin	eq	1.0.0
thin	eq	0.5.2
thin	eq	0.3.0

Rows per page:

1-10 of 211

References

github.com/macournoyer/thin

github.com/macournoyer/thin/blob/master/CHANGELOG

github.com/macournoyer/thin/commit/7bd027914c5ffd36bb408ef47dc749de3b6e063a

www.openwall.com/lists/oss-security/2009/09/12/1

github.com/advisories/GHSA-j24p-r6wx-r79w

github.com/rubysec/ruby-advisory-db/blob/master/gems/thin/CVE-2009-3287.yml

nvd.nist.gov/vuln/detail/CVE-2009-3287

0.005 Low

EPSS

Percentile

75.6%

JSON

Related for OSV:GHSA-J24P-R6WX-R79W