VYPR
← All advisories
High severityNVD Advisory· Published Sep 22, 2009· Updated Jun 16, 2026

CVE-2009-3287

CVE-2009-3287

Description

lib/thin/connection.rb in Thin web server before 1.2.4 relies on the X-Forwarded-For header to determine the IP address of the client, which allows remote attackers to spoof the IP address and hide activities via a modified X-Forwarded-For header.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
thinRubyGems
< 1.2.41.2.4

Affected products

22
  • Macournoyer/Thin21 versions
    cpe:2.3:a:macournoyer:thin:*:*:*:*:*:*:*:*+ 20 more
    • cpe:2.3:a:macournoyer:thin:*:*:*:*:*:*:*:*range: <=1.2.2
    • cpe:2.3:a:macournoyer:thin:0.4.0:*:*:*:*:*:*:*
    • cpe:2.3:a:macournoyer:thin:0.4.1:*:*:*:*:*:*:*
    • cpe:2.3:a:macournoyer:thin:0.5.0:*:*:*:*:*:*:*
    • cpe:2.3:a:macournoyer:thin:0.5.1:*:*:*:*:*:*:*
    • cpe:2.3:a:macournoyer:thin:0.5.2:*:*:*:*:*:*:*
    • cpe:2.3:a:macournoyer:thin:0.5.3:*:*:*:*:*:*:*
    • cpe:2.3:a:macournoyer:thin:0.5.4:*:*:*:*:*:*:*
    • cpe:2.3:a:macournoyer:thin:0.6.0:*:*:*:*:*:*:*
    • cpe:2.3:a:macournoyer:thin:0.6.3:*:*:*:*:*:*:*
    • cpe:2.3:a:macournoyer:thin:0.6.4:*:*:*:*:*:*:*
    • cpe:2.3:a:macournoyer:thin:0.7.0:*:*:*:*:*:*:*
    • cpe:2.3:a:macournoyer:thin:0.7.1:*:*:*:*:*:*:*
    • cpe:2.3:a:macournoyer:thin:0.8.0:*:*:*:*:*:*:*
    • cpe:2.3:a:macournoyer:thin:0.8.1:*:*:*:*:*:*:*
    • cpe:2.3:a:macournoyer:thin:0.8.2:*:*:*:*:*:*:*
    • cpe:2.3:a:macournoyer:thin:1.0.0:*:*:*:*:*:*:*
    • cpe:2.3:a:macournoyer:thin:1.1.0:*:*:*:*:*:*:*
    • cpe:2.3:a:macournoyer:thin:1.1.1:*:*:*:*:*:*:*
    • cpe:2.3:a:macournoyer:thin:1.2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:macournoyer:thin:1.2.1:*:*:*:*:*:*:*
  • ghsa-coords
    pkg:gem/thin
    Range: < 1.2.4

Patches

Vulnerability mechanics

References

6

News mentions

0

No linked articles in our index yet.