GitHub Advisoryadvisory · Go

GHSA-h395-qcrw-5vmq Inconsistent Interpretation of HTTP Requests in github.com/gin-gonic/gin

HIGH Published 2021-06-23 Modified 2024-05-20 Official page ↗
Aliases
CVE-2020-28483
Ecosystem
Go
Packages
github.com/gin-gonic/gin
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
Weaknesses
CWE-113, CWE-444
Reviewed
2021-05-12

Affected packages

• Go github.com/gin-gonic/gin: < 1.7.7 → fixed in 1.7.7

Description

When gin is exposed directly to the internet, a client's IP can be spoofed by setting the X-Forwarded-For header. This affects all versions of package github.com/gin-gonic/gin under 1.7.7.

Related

Alias · CVE (1)

  • CVE-2020-28483 This affects all versions of package github.com/gin-gonic/gin. vulnerability

Weakness · CWE (2)

  • CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers weakness
  • CWE-444 Inconsistent Interpretation of HTTP Requests weakness

References