id: GO-2023-2394
modules:
    - module: github.com/shift72/caddy-geo-ip
      vulnerable_at: 0.6.0
      packages:
        - package: github.com/shift72/caddy-geo-ip
          skip_fix: Relies on quic-go which doesn't build on Go 1.18.
summary: Spoofed source IP address in github.com/shift72/caddy-geo-ip
description: |-
    The caddy-geo-ip (aka GeoIP) middleware for Caddy 2 allows attackers to spoof
    their source IP address via an X-Forwarded-For header, which may bypass a
    protection mechanism (trusted_proxy directive in reverse_proxy or IP address
    range restrictions).
cves:
    - CVE-2023-50463
ghsas:
    - GHSA-rxg9-hgq7-8pwx
references:
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2023-50463
    - report: https://github.com/shift72/caddy-geo-ip/issues/4