CVE-2020-28483: HTTP Response Splitting
Gin-Gonic Gin Web Framework is vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability to inject arbitrary HTTP headers and cause the server to return a split response, once the URL is clicked. This would allow the attacker to perform further attacks, such as Web cache poisoning or cross-site scripting, and possibly obtain sensitive information.
Other sources
This affects all versions of package github.com/gin-gonic/gin. When gin is exposed directly to the internet, a client's IP can be spoofed by setting the X-Forwarded-For header.
— MITRE
When gin is exposed directly to the internet, a client's IP can be spoofed by setting the X-Forwarded-For header. This affects all versions of package github.com/gin-gonic/gin under 1.7.7.
— GitHub
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2020-28483?
CVE-2020-28483 is a vulnerability in package github.com/gin-gonic/gin that allows a client's IP to be spoofed by setting the X-Forwarded-For header.
How does CVE-2020-28483 affect package github.com/gin-gonic/gin?
CVE-2020-28483 affects all versions of package github.com/gin-gonic/gin under 1.7.7.
What is the severity of CVE-2020-28483?
CVE-2020-28483 has a severity rating of 7.1 (high).
How can I fix CVE-2020-28483?
To fix CVE-2020-28483, upgrade package github.com/gin-gonic/gin to version 1.7.7 or later.
Where can I find more information about CVE-2020-28483?
You can find more information about CVE-2020-28483 at the following references: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-28483), [GitHub Pull Request](https://github.com/gin-gonic/gin/pull/2632), [GitHub Commit](https://github.com/gin-gonic/gin/commit/bfc8ca285eb46dad60e037d57c545cd260636711).