CVE-2024-44930

2024-08-2900:00:00

mitre

github.com

serilog

v2.1.0

ip spoofing

vulnerability

AI Score

7.7

Confidence

High

EPSS

0.001

Percentile

17.7%

SSVC

Exploitation

none

Automatable

yes

Technical Impact

partial

JSON

Serilog before v2.1.0 was discovered to contain a Client IP Spoofing vulnerability, which allows attackers to falsify their IP addresses by specifying an arbitrary IP as a value of X-Forwarded-For or Client-Ip headers while performing HTTP requests.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:serilog:serilog:*:*:*:*:*:*:*:*"
    ],
    "vendor": "serilog",
    "product": "serilog",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "2.1.0",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]