CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
AI Score
Confidence
High
SSVC
Exploitation
none
Automatable
yes
Technical Impact
partial
NAXSI is an open-source maintenance web application firewall (WAF) for NGINX. An issue present starting in version 1.3 and prior to version 1.6 allows someone to bypass the WAF when a malicious X-Forwarded-For
IP matches IgnoreIP
IgnoreCIDR
rules. This old code was arranged to allow older NGINX versions to also support IgnoreIP
IgnoreCIDR
when multiple reverse proxies were present. The issue is patched in version 1.6. As a workaround, do not set any IgnoreIP
IgnoreCIDR
for older versions.
[
{
"cpes": [
"cpe:2.3:a:wargio:naxsi:*:*:*:*:*:nginx:*:*"
],
"vendor": "wargio",
"product": "naxsi",
"versions": [
{
"status": "affected",
"version": "1.3",
"lessThan": "1.6",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
}
]
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
AI Score
Confidence
High
SSVC
Exploitation
none
Automatable
yes
Technical Impact
partial