CVE-2024-52796: fallo de gravedad media en pglombardo PasswordPusher
Password Pusher's rate limiter can be bypassed by forging proxy headers
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.3epss 0.5%
Password Pusher, an open source application to communicate sensitive information over the web, comes with a configurable rate limiter. In versions prior to v1.49.0, the rate limiter could be bypassed by forging proxy headers allowing bad actors to send unlimited traffic to the site potentially causing a denial of service. In v1.49.0, a fix was implemented to only authorize proxies on local IPs which resolves this issue. As a workaround, one may add rules to one's proxy and/or firewall to not accept external proxy headers such as `X-Forwarded-*` from clients.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Productos afectados
pglombardo · PasswordPusherCVEs relacionadas — pglombardo PasswordPusher
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-62382MEDIUMPasswordPusher before v2.9.6 Authentication Bypass via Null ComparisonEPSS 1.2%CVE-2026-61458HIGHPasswordPusher < 2.9.2 Passphrase Brute-Force via Unthrottled EndpointEPSS 0.4%CVE-2026-87816HIGHPasswordPusher before 2.11.1 Race Condition View Limit BypassEPSS 0.4%CVE-2024-51989HIGHCross-site Scripting (XSS) Vulnerability in PasswordPusherEPSS 0.4%CVE-2026-41308MEDIUMPassword Pusher: JSON API `/p.json` file upload alias bypasses file-push authenticationEPSS 0.3%CVE-2024-56733MEDIUMPassword Pusher Allows Session Token Interception Leading to Potential HijackingEPSS 0.2%