CVE-2020-28483

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2020-28483
This affects all versions of package github.com/gin-gonic/gin. When gin is exposed directly to the internet, a client's IP can be spoofed by setting the X-Forwarded-For header.

7.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

5.8 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:N

Exploitability : 8.6 / Impact : 4.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
https://github.com/gin-gonic/gin/pull/2474%23issuecomment-729696437 Broken Link
https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGINGONICGIN-1041736 Patch Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:gin-gonic:gin:*:*:*:*:*:*:*:*
History

27 Jan 2021, 14:07

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 7.1 		v2 : 5.8
v3 : 7.1
CWE CWE-444
References (MISC) https://github.com/gin-gonic/gin/pull/2474%23issuecomment-729696437 - (MISC) https://github.com/gin-gonic/gin/pull/2474%23issuecomment-729696437 - Broken Link
References (MISC) https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGINGONICGIN-1041736 - (MISC) https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGINGONICGIN-1041736 - Patch, Third Party Advisory
CPE cpe:2.3:a:gin-gonic:gin:*:*:*:*:*:*:*:*

20 Jan 2021, 18:15

Type Values Removed Values Added
New CVE
Information

Published : 2021-01-20 18:15

Updated : 2023-12-10 13:41

NVD link : CVE-2020-28483

Mitre link : CVE-2020-28483

CVE.ORG link : CVE-2020-28483

JSON object : View

Products Affected

gin-gonic

  • gin
CWE
CWE-444

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')