Описание
An issue was discovered in Scytl sVote 2.1. Because the IP address from an X-Forwarded-For header (which can be manipulated client-side) is used for the internal application logs, an attacker can inject wrong IP addresses into these logs.
Ссылки
- ExploitThird Party Advisory
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1
cpe:2.3:a:scytl:secure_vote:2.1:*:*:*:*:*:*:*
EPSS
Процентиль: 52%
0.00285
Низкий
6.5 Medium
CVSS3
6.4 Medium
CVSS2
Дефекты
CWE-290
Связанные уязвимости
github
больше 3 лет назад
An issue was discovered in Scytl sVote 2.1. Because the IP address from an X-Forwarded-For header (which can be manipulated client-side) is used for the internal application logs, an attacker can inject wrong IP addresses into these logs.
EPSS
Процентиль: 52%
0.00285
Низкий
6.5 Medium
CVSS3
6.4 Medium
CVSS2
Дефекты
CWE-290