CVE-2025-6504
Possibilities of IP Spoofing via X-Forwarded-For (XFF) Header
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Possibilities of IP Spoofing via X-Forwarded-For (XFF) Header
In HDP Server versions below 4.6.2.2978 on Linux, unauthorized access could occur via IP spoofing using the X-Forwarded-For header. Since XFF is a client-controlled header, it could be spoofed, allowing unauthorized access if the spoofed IP matched a whitelisted range. This vulnerability could be exploited to bypass IP restrictions, though valid user credentials would still be required for resource access.
Reserved 2025-06-23 | Published 2025-07-29 | Updated 2025-07-29 | Assigner ProgressSoftwareUnauthorized Access to Sensitive resources
community.progress.com/...Bulletin-July-2025---CVE-2025-6504
Support options
