~ / search / GHSA-j9gq-w73w-9h6c

GHSA-j9gq-w73w-9h6c

pretix potential IP address spoofing vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-44463

Packages

EcosystemPackageAffectedFixed in
PyPI pretix < 2023.7.1 2023.7.1

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in pretix before 2023.7.1. Incorrect parsing of configuration files causes the application to trust unchecked X-Forwarded-For headers even though it has not been configured to do so. This can lead to IP address spoofing by users of the application.

References

External links from the advisory. They lead to third-party sites.