Description

IP address spoofing when proxying using mod_remoteip and mod_rewrite For configurations using proxying with mod_remoteip and certain mod_rewrite rules, an attacker could spoof their IP address for logging and PHP scripts. Note this issue was fixed in Apache HTTP Server 2.4.24 but was retrospectively allocated a low severity CVE in 2020.

Remediation

References

CVE-2020-11985

Related Vulnerabilities

Oracle Database Server Deserialization of Untrusted Data Vulnerability (CVE-2018-14719)

WordPress Plugin CMS Press Cross-Site Scripting (0.2.3)

Moodle Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2006-4785)

WordPress Plugin ThemeGrill Demo Importer Security Bypass (1.6.1)

WordPress Server-Side Request Forgery (SSRF) Vulnerability (CVE-2016-4029)

Severity

Medium

Classification

CVE-2020-11985 CWE-345 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Tags

Missing Update Known Vulnerabilities