CVE-2023-44463

Advisory

An issue was discovered in pretix before 2023.7.1. Incorrect parsing of configuration files causes the application to trust unchecked X-Forwarded-For headers even though it has not been configured to do so. This can lead to IP address spoofing by users of the application.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-44463
• https://github.com/pretix/pretix/tags
• https://github.com/pretix/pretix/compare/v2023.7.0...v2023.7.1
• https://pretix.eu/about/en/ticketing
• https://github.com/pretix/pretix/commit/ccdce2ccb8207b82501af3c03f50abc0f819b469
• https://pretix.eu/about/en/blog/20230911-release-2023-7-1/