CVE-2009-3287

Published: Sep 22, 2009Modified: Apr 23, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

lib/thin/connection.rb in Thin web server before 1.2.4 relies on the X-Forwarded-For header to determine the IP address of the client, which allows remote attackers to spoof the IP address and hide activities via a modified X-Forwarded-For header.

Affected (21)

Products: Macournoyer: Thin

Macournoyer

1 product

Thin

Configuration A

21 vulnerable

Vulnerable Software	Affected Versions
Macournoyer Thin	Up to 1.2.2
Macournoyer Thin	Version 0.4.0
Macournoyer Thin	Version 0.4.1
Macournoyer Thin	Version 0.5.0
Macournoyer Thin	Version 0.5.1
Macournoyer Thin	Version 0.5.2
Macournoyer Thin	Version 0.5.3
Macournoyer Thin	Version 0.5.4
Macournoyer Thin	Version 0.6.0
Macournoyer Thin	Version 0.6.3
Macournoyer Thin	Version 0.6.4
Macournoyer Thin	Version 0.7.0
Macournoyer Thin	Version 0.7.1
Macournoyer Thin	Version 0.8.0
Macournoyer Thin	Version 0.8.1
Macournoyer Thin	Version 0.8.2
Macournoyer Thin	Version 1.0.0
Macournoyer Thin	Version 1.1.0
Macournoyer Thin	Version 1.1.1
Macournoyer Thin	Version 1.2.0
Macournoyer Thin	Version 1.2.1