CVE-2009-3287
High severity vulnerability that affects thin
lib/thin/connection.rb in Thin web server before 1.2.4 relies on the X-Forwarded-For header to determine the IP address of the client, which allows remote attackers to spoof the IP address and hide activities via a modified X-Forwarded-For header.
Exploit likelihood
What each source reports
NVD Score used
lib/thin/connection.rb in Thin web server before 1.2.4 relies on the X-Forwarded-For header to determine the IP address of the client, which allows remote attackers to spoof the IP address and hide activities via a modified X-Forwarded-For header.
- Record
CVE-2009-3287- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
lib/thin/connection.rb in Thin web server before 1.2.4 relies on the X-Forwarded-For header to determine the IP address of the client, which allows remote attackers to spoof the IP address and hide activities via a modified X-Forwarded-For header.
- Record
CVE-2009-3287- Updated
- 2026-11-02
EUVDEUVD-2017-0256 No score
lib/thin/connection.rb in Thin web server before 1.2.4 relies on the X-Forwarded-For header to determine the IP address of the client, which allows remote attackers to spoof the IP address and hide activities via a modified X-Forwarded-For header.
- Record
EUVD-2017-0256- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-j24p-r6wx-r79w No score
High severity vulnerability that affects thin
lib/thin/connection.rb in Thin web server before 1.2.4 relies on the X-Forwarded-For header to determine the IP address of the client, which allows remote attackers to spoof the IP address and hide activities via a modified X-Forwarded-For header.
- Record
GHSA-j24p-r6wx-r79w- Weakness
- CWE-20
- Updated
- 2026-11-02
OSV No score
lib/thin/connection.rb in Thin web server before 1.2.4 relies on the X-Forwarded-For header to determine the IP address of the client, which allows remote attackers to spoof the IP address and hide activities via a modified X-Forwarded-For header.
- Record
CVE-2009-3287- Updated
- 2026-11-02
OSVDEBIAN-CVE-2009-3287 No score
lib/thin/connection.rb in Thin web server before 1.2.4 relies on the X-Forwarded-For header to determine the IP address of the client, which allows remote attackers to spoof the IP address and hide activities via a modified X-Forwarded-For header.
- Record
DEBIAN-CVE-2009-3287- Updated
- 2026-11-02
OSVGHSA-j24p-r6wx-r79w No score
High severity vulnerability that affects thin
lib/thin/connection.rb in Thin web server before 1.2.4 relies on the X-Forwarded-For header to determine the IP address of the client, which allows remote attackers to spoof the IP address and hide activities via a modified X-Forwarded-For header.
- Record
GHSA-j24p-r6wx-r79w- Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
thinRubyGems |
before 1.2.4 | 1.2.4 |
thinDebian:12 |
before 1.2.4-1 | 1.2.4-1 |
thinDebian:13 |
before 1.2.4-1 | 1.2.4-1 |
thinDebian:14 |
before 1.2.4-1 | 1.2.4-1 |
thinRubyGems |
before 1.2.4, plus listed versions 0.3.00.4.00.4.10.5.00.5.2 Show 16 moreShow less0.5.30.5.40.6.00.6.10.6.20.6.30.6.40.7.00.7.10.8.00.8.10.8.21.0.01.2.11.2.21.2.3 |
1.2.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-3287 is a high vulnerability (CVSS 7.5) in Macournoyer Thin, published September 22, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.38%, the 72nd percentile. Fixed in thin 1.2.4.
References
github.com/macournoyer/thin/blob/master/CHANGELOG
openwall.com/lists/oss-security/2009/09/12/1
nvd.nist.gov/vuln/detail/CVE-2009-3287
security-tracker.debian.org/tracker/CVE-2009-3287