CVE-2020-11985

An attacker can fake their IP address when Apache uses certain proxy and URL rewriting modules together. This tricks logging systems and web applications into thinking the request came from a different source.

When mod_remoteip and mod_rewrite are configured for proxying, an attacker can manipulate request headers to spoof their source IP address. The vulnerability allows bypass of IP-based access controls and falsification of audit logs. Exploitation requires the vulnerable module configuration to be active on the target server.