CVE-2024-52796

Summary

CVE-2024-52796 is a vulnerability affecting the Password Pusher application, version prior to 1.49.0. The app includes a configurable rate limiter, which can be bypassed by malicious actors through forged proxy headers, resulting in potential denial of service attacks. In version 1.49.0, this issue was resolved by authorizing only local IP proxies. A temporary solution involves adding rules to firewalls or proxies to block external `X-Forwarded-*` headers from clients.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.