CyberRota Analysis
AI-GeneratedThe vulnerability in Glance through version 0.8.5 allows unauthenticated attackers to exploit the authentication handler by spoofing IP addresses via the X-Forwarded-For header, effectively bypassing brute-force lockout protections. This enables attackers to conduct unlimited credential guessing attempts without triggering account lockouts, posing a significant risk to systems using this version. Organizations utilizing Glance should prioritize patching this vulnerability to secure their authentication mechanisms against potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Glance through 0.8.5 contains an IP address spoofing vulnerability in the authentication handler that allows unauthenticated attackers to bypass brute-force lockout protections by supplying arbitrary values in the X-Forwarded-For request header when the server proxied option is enabled. Attackers can manipulate the leftmost value of the X-Forwarded-For header to make each login attempt appear to originate from a distinct IP address, preventing the per-IP failed-login counter from reaching the lockout threshold and enabling unlimited credential guessing against the authentication endpoint.