CVE-2025-6504 — Possibilities of IP Spoofing via X-Forwarded-For (XFF) Header
In HDP Server versions below 4.6.2.2978 on Linux, unauthorized access could occur via IP spoofing using the X-Forwarded-For header. Since XFF is a client-controlled header, it…
Published: 2025-07-29 · CVSS: 8.4 · CVSS 3.1
In HDP Server versions below 4.6.2.2978 on Linux, unauthorized access could occur via IP spoofing using the X-Forwarded-For header. Since XFF is a client-controlled header, it could be spoofed, allowing unauthorized access if the spoofed IP matched a whitelisted range. This vulnerability could be exploited to bypass IP restrictions, though valid user credentials would still be required for resource access.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7