Pairdrop
Monthly
IP spoofing in PairDrop through 1.11.2 lets unauthenticated remote attackers who already know a victim's public IP address join that victim's discovery room on self-hosted instances that are not deployed behind Cloudflare, so the attacker appears as a local device and can send or receive files. Impact is limited to low confidentiality and integrity loss within the discovery-room session (CVSS 2.3 / assessed 3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N), with no code execution or availability impact, and no public exploit identified at time of analysis. Exploitation requires three concrete conditions: a self-hosted PairDrop instance through 1.11.2 that is not correctly fronted by Cloudflare, prior knowledge of the victim's public IP, and user interaction to actually exchange files.
IP spoofing in PairDrop through 1.11.2 lets unauthenticated remote attackers who already know a victim's public IP address join that victim's discovery room on self-hosted instances that are not deployed behind Cloudflare, so the attacker appears as a local device and can send or receive files. Impact is limited to low confidentiality and integrity loss within the discovery-room session (CVSS 2.3 / assessed 3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N), with no code execution or availability impact, and no public exploit identified at time of analysis. Exploitation requires three concrete conditions: a self-hosted PairDrop instance through 1.11.2 that is not correctly fronted by Cloudflare, prior knowledge of the victim's public IP, and user interaction to actually exchange files.