CVE-2023-44463

MEDIUM

pretix < 2023.7.1 - IP Address Spoofing via X-Forwarded-For Header

Title source: llm
STIX 2.1

Description

An issue was discovered in pretix before 2023.7.1. Incorrect parsing of configuration files causes the application to trust unchecked X-Forwarded-For headers even though it has not been configured to do so. This can lead to IP address spoofing by users of the application.

References (5)

Core 5

Scores

CVSS v3 5.3
EPSS 0.0051
EPSS Percentile 39.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-290
Status published
Products (2)
pypi/pretix 0 - 2023.7.1PyPI
rami/pretix < 2023.7.1
Published Oct 02, 2023
Tracked Since Feb 18, 2026