CVE-2025-65328

{
  "id": "CVE-2025-65328",
  "sourceIdentifier": "[email protected]",
  "published": "2026-01-05T16:15:42.763",
  "lastModified": "2026-11-04T22:10:00.210",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Mega-Fence (webgate-lib.*) 25.1.914 and prior trusts the first value of the X-Forwarded-For (XFF) header as the client IP without validating a trusted proxy chain. An attacker can supply an arbitrary XFF value in a remote request to spoof the client IP, which is then propagated to security-relevant state (e.g., WG_CLIENT_IP cookie). Deployments that rely on this value for IP allowlists may be bypassed."
    },
    {
      "lang": "es",
      "value": "Mega-Fence (webgate-lib.*) 25.1.914 y anteriores confía en el primer valor del encabezado X-Forwarded-For (XFF) como la IP del cliente sin validar una cadena de proxy de confianza. Un atacante puede proporcionar un valor XFF arbitrario en una solicitud remota para suplantar la IP del cliente, que luego se propaga a un estado relevante para la seguridad (por ejemplo, la cookie WG_CLIENT_IP). Las implementaciones que dependen de este valor para listas blancas de IP pueden ser eludidas."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 2.5
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-01-05T21:08:04.173996Z",
          "id": "CVE-2025-65328",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-807"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:mega-fence_project:mega-fence:*:*:*:*:*:*:*:*",
              "versionEndIncluding": "25.1.914",
              "matchCriteriaId": "36D2A6D4-72EC-4C0B-96C4-34AFDD4762A6"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://drive.proton.me/urls/MY05PVBFXG#xDd2Xqy98WM9",
      "source": "[email protected]",
      "tags": [
        "Broken Link"
      ]
    },
    {
      "url": "https://raw.githubusercontent.com/p1aintext/CVE/main/CVE-2025-65328.md",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ]
    }
  ]
}