Description
Password Pusher from 1.49.0 before 2.17.0 contains an IP spoofing vulnerability that allows remote clients to forge the recorded request IP via unanchored trusted-proxy regular expressions. Clients in 110.0.0.0/8 or 210.0.0.0/8, or connecting directly, can supply X-Forwarded-For values to falsify audit log entries and shift password generator rate limits.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| pglombardo | PasswordPusher | 1.49.0 – < 2.17.0 | 2.17.0 |
References
- GitHub Security Advisory (GHSA-p2xh-x263-68qc) vendor-advisory
- VulnCheck Advisory: Password Pusher 1.49.0 before 2.17.0 IP Spoofing via Unanchored Trusted-Proxy Regex third-party-advisory