Description
Various methods in WEBrick::HTTPRequest in Ruby 1.9.2 and 1.8.7 and earlier do not validate the X-Forwarded-For, X-Forwarded-Host and X-Forwarded-Server headers in requests, which might allow remote attackers to inject arbitrary text into log files or bypass intended address parsing via a crafted header.
Remediation
References
Related Vulnerabilities
WordPress Plugin Asset CleanUp:Page Speed Booster Cross-Site Scripting (1.3.6.7)
Drupal Other Vulnerability (CVE-2006-1226)
Moodle Improper Input Validation Vulnerability (CVE-2022-35650)
WordPress Plugin WP-Members Membership Multiple Cross-Site Scripting Vulnerabilities (2.8.9)
Undertow Missing Authorization Vulnerability (CVE-2019-10184)