Threats tagged 'ghsa-4p3m-fhg8-5wfc'

PairDrop versions up to 1.11.2 have an IP spoofing vulnerability in the Peer._setIP function. This flaw allows remote attackers to join discovery rooms of other networks by forging the cf-connecting-ip header. Attackers who know a victim's public IP can impersonate a local device on self-hosted PairDrop instances that are not behind Cloudflare, enabling unauthorized file send or receive actions.