CVE-2024-44930 Serilog Client IP Spoofing vulnerability
Attackers can spoof client IP addresses in logs by manipulating HTTP headers, compromising audit trails and security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-44930?
CVE-2024-44930 is a medium-severity vulnerability in n/a, published on 29 Aug 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Serilog before v2.1.0 was discovered to contain a Client IP Spoofing vulnerability, which allows attackers to falsify their IP addresses by specifying an arbitrary IP as a value of X-Forwarded-For or Client-Ip headers while performing HTTP requests.
Weakness: CWE-79
Which versions are affected by CVE-2024-44930?
2 open source packages ship an affected version, including Serilog.Enrichers.ClientInfo. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
Serilog.Enrichers.ClientInfo NuGet | All versions | 2.1.0 |
Serilog.Enrichers.ClientInfo NuGet | All versions | 2.1.0 |
Products include Serilog-Contrib Serilog-Enrichers-Clientinfo.
How do I fix CVE-2024-44930?
Upgrade Serilog.Enrichers.ClientInfo to 2.1.0 or later.
Is CVE-2024-44930 being exploited?
There is no known exploitation of CVE-2024-44930 in the wild and no public exploit code.
Sources
Also known as GHSA-5x5q-cqf6-gj8r.