A vulnerability was determined in Saleor up to 3.20.118\/3.21.54\/3.22.47\/3.23.14. This vulnerability affects the function get_client_ip of the file saleor\/account\/throttling.py. Executing a manipulation can lead to improper restriction of excessive authentication attempts. The attack can be executed remotely. The attack requires a high level of complexity. It is stated that the exploitability is difficult. The exploit has been publicly disclosed and may be utilized. The projects own issue #19203 internal ticket admits “IP can be spoofed in most deployments” and that its REAL_IP_ENVIRON-type setting bypasses get_client_ip; fix (right-to-left RFC 7239 hop selection) proposed but still unmerged. The vendor explains within an email, that “[t]his is not a vulnerability, this is working at intended, Saleor expects XFF to be configured properly”.<\/p>\n","protected":false},"excerpt":{"rendered":"
A vulnerability was determined in Saleor up to 3.20.118\/3.21.54\/3.22.47\/3.23.14. This vulnerability affects the function get_client_ip of the file saleor\/account\/throttling.py. Executing a manipulatio<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-26626","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/26626","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=26626"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=26626"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=26626"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}