A vulnerability was found in mod_wsgi. The X-Client-IP header is not removed from a request from an untrusted proxy, allowing an attacker…

Description

A vulnerability was found in mod_wsgi. The X-Client-IP header is not removed from a request from an untrusted proxy, allowing an attacker to pass the X-Client-IP header to the target WSGI application because the condition to remove it is missing.

Scores

EPSS (exploitation in 30 days)

0.94% · top 39% of all CVEs (5 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

• CWE-348 (opens in a new tab)All about CWE-348 and its CVEs
• CWE-345 (opens in a new tab)All about CWE-345 and its CVEs

Affected products

• mod_wsgi

  • affected mod_wsgi versions prior to 4.9.3

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• PyPImod-wsgiGHSA-7527-8855-9cf8 (opens in a new tab)

References (4)

• https://modwsgi.readthedocs.io/en/latest/release-notes/version-4.9.3.html (opens in a new tab)x_refsource_MISCx_transferred
• https://github.com/GrahamDumpleton/mod_wsgi/blob/4.9.2/src/server/mod_wsgi.c#L13940-L13941 (opens in a new tab)x_refsource_MISCx_transferred
• https://github.com/GrahamDumpleton/mod_wsgi/blob/4.9.2/src/server/mod_wsgi.c#L14046-L14082 (opens in a new tab)x_refsource_MISCx_transferred
• [debian-lts-announce] 20220915 [SECURITY] [DLA 3111-1] mod-wsgi security update (opens in a new tab)mailing-listx_refsource_MLISTx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-7527-8855-9cf8 (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2022-2255](https://trackcve.app/badge/CVE-2022-2255.svg)](https://trackcve.app/cve/CVE-2022-2255)

Record last updated 3 Aug 2024, 00:32 UTC.