Speedtest Tracker through 1.15.0 contains an IP allowlist bypass vulnerability that allows unauthenticated remote attackers to evade ALLOWED_IPS and…
Speedtest Tracker through 1.15.0 contains an IP allowlist bypass vulnerability that allows unauthenticated remote attackers to evade ALLOWED_IPS and Prometheus allowlists by spoofing X-Forwarded-For headers. Because bootstrap/app.php trusts every peer as a proxy, attackers can supply an allowlisted address to read /prometheus metrics and reach protected web and API endpoints.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Prometheus
- Product
- Prometheus / Alertmanager
- CVSS
- 3.7
- Exposure class
- Network management
Why it ranks 5 (Routine)
- Product class: network management
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.