CVE-2024-52796

Summary

CVE-2024-52796: A vulnerability was discovered in Password Pusher, an open-source communication tool. In versions prior to 1.49.0, the application's rate limiter could be bypassed by forging proxy headers, enabling bad actors to inundate the site with unlimited traffic and potentially cause a denial of service. The issue was resolved in version 1.49.0 by implementing a fix that only authorizes local IPs as proxies. As a temporary measure, users can add rules to their proxy and firewall to block external proxy headers such as `X-Forwarded-*` from clients.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.