VulnerabilityDeferred

CVE-2024-54450

An issue was discovered in Kurmi Provisioning Suite 7.9.0.33.

CRITICAL 9.4EPSS 0.53%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.53%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

An issue was discovered in Kurmi Provisioning Suite 7.9.0.33. If an X-Forwarded-For header is received during authentication, the Kurmi application will record the (possibly forged) IP address mentioned in that header rather than the real IP address that the user logged in from. This fake IP address can later be displayed in the My Account popup that shows the IP address that was used to log in.

CVSS 3.1: 9.4 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
EPSS: 0.53% probability · 43th percentile
CISA KEV: Not listed
Weakness: CWE-290
Source: cve@mitre.org

References

https://kurmi-software.com
https://kurmi-software.com/cve/cve-2024-54450/

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.