Reverse Proxy Header
Monthly
Improper validation of consistency within input in the Drupal contributed module Reverse Proxy Header (versions 0.0.0 through 1.1.1) allows manipulation of user-controlled variables derived from client-supplied HTTP headers. Affected sites are those that install the module and configure it to trust client-identifying headers from an upstream reverse proxy; in that deployment, unauthenticated remote attackers (CVSS PR:N) can send inconsistent or conflicting header values that the module fails to reconcile, potentially influencing downstream logic that consumes those variables. This is a moderate-severity (CVSS 5.3), low-priority issue in practice: EPSS is only 0.30% (21st percentile), there is no CISA KEV listing for active exploitation, and no public exploit code has been identified at time of analysis. A vendor patch is available in version 1.1.2.
Improper validation of consistency within input in the Drupal contributed module Reverse Proxy Header (versions 0.0.0 through 1.1.1) allows manipulation of user-controlled variables derived from client-supplied HTTP headers. Affected sites are those that install the module and configure it to trust client-identifying headers from an upstream reverse proxy; in that deployment, unauthenticated remote attackers (CVSS PR:N) can send inconsistent or conflicting header values that the module fails to reconcile, potentially influencing downstream logic that consumes those variables. This is a moderate-severity (CVSS 5.3), low-priority issue in practice: EPSS is only 0.30% (21st percentile), there is no CISA KEV listing for active exploitation, and no public exploit code has been identified at time of analysis. A vendor patch is available in version 1.1.2.