How severe is CVE-2024-35175?

This vulnerability has a severity rating of MEDIUM with a CVSS score of 5.3 out of 10.

What type of vulnerability is CVE-2024-35175?

This is classified as CWE-345, which is a common weakness in software security.

CVE-2024-35175 - MEDIUM Severity | CVSS 5.3

Vulnerability Description

sshpiper is a reverse proxy for sshd. Starting in version 1.0.50 and prior to version 1.3.0, the way the proxy protocol listener is implemented in sshpiper can allow an attacker to forge their connecting address. Commit 2ddd69876a1e1119059debc59fe869cb4e754430 added the proxy protocol listener as the only listener in sshpiper, with no option to toggle this functionality off. This means that any connection that sshpiper is directly (or in some cases indirectly) exposed to can use proxy protocol to forge its source address. Any users of sshpiper who need logs from it for whitelisting/rate limiting/security investigations could have them become much less useful if an attacker is sending a spoofed source address. Version 1.3.0 contains a patch for the issue.

Related Vulnerabilities

CVE-2015-9232

MEDIUM

CVSS:5.3(Medium)

The Good for Enterprise application 3.0.0.415 for Android does not use signature protection for its Authentication Delegation API intent. Also, the Good Dynamic application activation process does not...

CWE-3452015

CVE-2017-10862

MEDIUM

CVSS:5.3(Medium)

jwt-scala 1.2.2 and earlier fails to verify token signatures correctly which may lead to an attacker being able to pass specially crafted JWT data as a correctly signed token.

CWE-3452017

CVE-2018-17938

MEDIUM

CVSS:5.3(Medium)

Zimbra Collaboration before 8.8.10 GA allows text content spoofing via a loginErrorCode value.

CWE-3452018

CVE-2019-11737

MEDIUM

CVSS:5.3(Medium)

If a wildcard ('*') is specified for the host in Content Security Policy (CSP) directives, any port or path restriction of the directive will be ignored, leading to CSP directives not being properly a...

CWE-3452019

CVE-2019-12620

MEDIUM

CVSS:5.3(Medium)

A vulnerability in the statistics collection service of Cisco HyperFlex Software could allow an unauthenticated, remote attacker to inject arbitrary values on an affected device. The vulnerability is ...

CWE-3452019

CVE-2019-15162

MEDIUM

CVSS:5.3(Medium)

rpcapd/daemon.c in libpcap before 1.9.1 on non-Windows platforms provides details about why authentication failed, which might make it easier for attackers to enumerate valid usernames.

CWE-3452019