{"id":"DRUPAL-CONTRIB-2025-111","aliases":["CVE-2025-10929","GHSA-fg8x-q69g-4qp3"],"title":"DRUPAL-CONTRIB-2025-111","description":"This module allows you to specify an HTTP header name to determine the client's IP address.\n\nThe module doesn't sufficiently handle all cases under the scenario if Drupal Core settings `$settings['reverse_proxy']` is set to TRUE and `$settings['reverse_proxy_addresses']` is configured.\n\nThis vulnerability allows an attacker to spoof a request IP address (as Drupal sees it), potentially bypassing a variety of controls.","severity":"medium","score":5.3,"published":"2025-09-24T17:28:05.000Z","modified":"2026-09-10T03:45:16.560Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist:https://packages.drupal.org/8","name":"drupal/reverse_proxy_header","ranges":[{"events":[{"introduced":"0"},{"fixed":"1.1.2"}],"type":"ECOSYSTEM","database_specific":{"constraint":"<1.1.2"}}],"versions":[],"fixed":["1.1.2"]},{"ecosystem":"Packagist","name":"drupal/reverse_proxy_header","ranges":[{"events":[{"introduced":"0"},{"fixed":"1.1.2"}],"type":"ECOSYSTEM"}],"versions":[],"fixed":["1.1.2"]}],"references":["https://www.drupal.org/sa-contrib-2025-111","https://nvd.nist.gov/vuln/detail/CVE-2025-10929"],"sources":[{"name":"OSV","id":"DRUPAL-CONTRIB-2025-111","modified":"2026-09-10T03:45:16.560209348Z","url":"https://osv.dev/vulnerability/DRUPAL-CONTRIB-2025-111"},{"name":"OSV","id":"GHSA-fg8x-q69g-4qp3","modified":"2025-12-10T23:41:00.367986Z","url":"https://osv.dev/vulnerability/GHSA-fg8x-q69g-4qp3"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3}]}