PairDrop through 1.11.2 contains an IP spoofing vulnerability in Peer._setIP that allows remote attackers to join other networks' discovery rooms by…
PairDrop through 1.11.2 contains an IP spoofing vulnerability in Peer._setIP that allows remote attackers to join other networks' discovery rooms by supplying a forged cf-connecting-ip header. Attackers who know a victim's public IP can appear as a local device on self-hosted instances not behind Cloudflare to send or receive files.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Cloudflare
- Product
- Cloudflare WARP / Workers / Zero Trust
- CVSS
- 4.2
- Exposure class
- Cloud platform
Why it ranks 8 (Routine)
- CVSS 4.2 medium
- Product class: cloud platform
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.