Password Pusher
Approved changes feed: RSS · Atom
cpe:2.3:a:pglombardo:password_pusher:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Pglombardo (462b123d-e5ad-59b1-aea8-0b5331928018) |
|---|---|
| Product | Password Pusher (587ffdd8-70a6-54a6-a021-090a0dd28601) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-52796 |
vulnerable | 2026-06-08 06:52:16.250102 |
Password Pusher's rate limiter can be bypassed by forging proxy headers
MEDIUM (5.3)
Password Pusher, an open source application to communicate sensitive information over the web, comes with a configurable rate limiter. In versions prior to v1.49.0, the rate limiter could be bypassed by forging proxy headers allowing bad actors to send unlimited traffic to the site potentially causing a denial of service. In v1.49.0, a fix was implemented to only authorize proxies on local IPs which resolves this issue. As a workaround, one may add rules to one's proxy and/or firewall to not accept external proxy headers such as `X-Forwarded-*` from clients.
Published: 2024-11-20T16:15:19.478Z
Updated: 2024-11-20T16:48:09.821Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.