{"schemaVersion":3,"id":"CVE-2020-8984","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta allowed IP address spoofing via the X-Forwarded-For header.","dates":{"published":"2020-03-24T20:12:07.000Z","modified":"2024-08-04T10:19:19.710Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.5,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":5,"severity":"medium","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00491,"percentile":0.41252,"severity":"low","asOf":"2026-10-22T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-22T00:00:00.000Z","baselineScore":0.00491},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-10-22T00:00:00.000Z","score":0.00491,"percentile":0.41252}],"last30":[{"date":"2026-09-22T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00491,"percentile":null},{"date":"2026-10-22T00:00:00.000Z","score":0.00491,"percentile":0.41252}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-346","name":"Origin Validation Error","description":"The product does not properly verify that the source of data or communication is valid.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/346.html"}],"affected":[{"vendor":"zend","product":"zendto","name":"zendto","label":"zendto","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"3.10","noFixRecorded":false,"fixedIn":null},{"text":"3.11","noFixRecorded":false,"fixedIn":null},{"text":"3.12","noFixRecorded":false,"fixedIn":null},{"text":"3.13","noFixRecorded":false,"fixedIn":null},{"text":"3.20","noFixRecorded":false,"fixedIn":null},{"text":"3.51","noFixRecorded":false,"fixedIn":null},{"text":"3.52","noFixRecorded":false,"fixedIn":null},{"text":"3.53","noFixRecorded":false,"fixedIn":null},{"text":"3.54","noFixRecorded":false,"fixedIn":null},{"text":"3.55","noFixRecorded":false,"fixedIn":null},{"text":"3.56-2","noFixRecorded":false,"fixedIn":null},{"text":"3.57","noFixRecorded":false,"fixedIn":null},{"text":"3.58","noFixRecorded":false,"fixedIn":null},{"text":"3.59","noFixRecorded":false,"fixedIn":null},{"text":"3.60","noFixRecorded":false,"fixedIn":null},{"text":"3.61","noFixRecorded":false,"fixedIn":null},{"text":"3.62","noFixRecorded":false,"fixedIn":null},{"text":"3.63","noFixRecorded":false,"fixedIn":null},{"text":"3.64","noFixRecorded":false,"fixedIn":null},{"text":"3.65","noFixRecorded":false,"fixedIn":null},{"text":"3.70-2","noFixRecorded":false,"fixedIn":null},{"text":"3.71","noFixRecorded":false,"fixedIn":null},{"text":"3.72","noFixRecorded":false,"fixedIn":null},{"text":"3.73","noFixRecorded":false,"fixedIn":null},{"text":"3.74","noFixRecorded":false,"fixedIn":null},{"text":"3.75","noFixRecorded":false,"fixedIn":null},{"text":"3.90","noFixRecorded":false,"fixedIn":null},{"text":"3.91","noFixRecorded":false,"fixedIn":null},{"text":"3.92","noFixRecorded":false,"fixedIn":null},{"text":"3.93","noFixRecorded":false,"fixedIn":null},{"text":"3.94","noFixRecorded":false,"fixedIn":null},{"text":"4.00","noFixRecorded":false,"fixedIn":null},{"text":"4.01","noFixRecorded":false,"fixedIn":null},{"text":"4.02","noFixRecorded":false,"fixedIn":null},{"text":"4.03-3","noFixRecorded":false,"fixedIn":null},{"text":"4.05-2","noFixRecorded":false,"fixedIn":null},{"text":"4.06-2","noFixRecorded":false,"fixedIn":null},{"text":"4.07-1","noFixRecorded":false,"fixedIn":null},{"text":"4.08-4","noFixRecorded":false,"fixedIn":null},{"text":"4.09-1","noFixRecorded":false,"fixedIn":null},{"text":"4.10-4","noFixRecorded":false,"fixedIn":null},{"text":"4.10-5","noFixRecorded":false,"fixedIn":null},{"text":"4.11-1","noFixRecorded":false,"fixedIn":null},{"text":"4.11-2","noFixRecorded":false,"fixedIn":null},{"text":"4.11-3","noFixRecorded":false,"fixedIn":null},{"text":"4.11-4","noFixRecorded":false,"fixedIn":null},{"text":"4.11-5","noFixRecorded":false,"fixedIn":null},{"text":"4.11-7","noFixRecorded":false,"fixedIn":null},{"text":"4.11-8","noFixRecorded":false,"fixedIn":null},{"text":"4.11-9","noFixRecorded":false,"fixedIn":null},{"text":"4.11-10","noFixRecorded":false,"fixedIn":null},{"text":"4.11-11","noFixRecorded":false,"fixedIn":null},{"text":"4.11-12","noFixRecorded":false,"fixedIn":null},{"text":"4.11-13","noFixRecorded":false,"fixedIn":null},{"text":"4.11-14","noFixRecorded":false,"fixedIn":null},{"text":"4.12-5","noFixRecorded":false,"fixedIn":null},{"text":"4.12-6","noFixRecorded":false,"fixedIn":null},{"text":"4.13-1","noFixRecorded":false,"fixedIn":null},{"text":"4.20-2","noFixRecorded":false,"fixedIn":null},{"text":"4.20-3","noFixRecorded":false,"fixedIn":null},{"text":"4.20-5","noFixRecorded":false,"fixedIn":null},{"text":"4.20-6","noFixRecorded":false,"fixedIn":null},{"text":"4.20-7","noFixRecorded":false,"fixedIn":null},{"text":"4.25-3","noFixRecorded":false,"fixedIn":null},{"text":"4.27-1","noFixRecorded":false,"fixedIn":null},{"text":"4.27-2","noFixRecorded":false,"fixedIn":null},{"text":"4.27-4","noFixRecorded":false,"fixedIn":null},{"text":"4.27-5","noFixRecorded":false,"fixedIn":null},{"text":"4.27-6","noFixRecorded":false,"fixedIn":null},{"text":"4.27-7","noFixRecorded":false,"fixedIn":null},{"text":"4.28-1","noFixRecorded":false,"fixedIn":null},{"text":"4.28-2","noFixRecorded":false,"fixedIn":null},{"text":"5.00-1","noFixRecorded":false,"fixedIn":null},{"text":"5.00-2","noFixRecorded":false,"fixedIn":null},{"text":"5.01-5","noFixRecorded":false,"fixedIn":null},{"text":"5.02-5","noFixRecorded":false,"fixedIn":null},{"text":"5.03-1","noFixRecorded":false,"fixedIn":null},{"text":"5.04-7","noFixRecorded":false,"fixedIn":null},{"text":"5.09-13","noFixRecorded":false,"fixedIn":null},{"text":"5.10-1","noFixRecorded":false,"fixedIn":null},{"text":"5.10-2","noFixRecorded":false,"fixedIn":null},{"text":"5.11-1","noFixRecorded":false,"fixedIn":null},{"text":"5.11-2","noFixRecorded":false,"fixedIn":null},{"text":"5.11-3","noFixRecorded":false,"fixedIn":null},{"text":"5.11-4","noFixRecorded":false,"fixedIn":null},{"text":"5.11-5","noFixRecorded":false,"fixedIn":null},{"text":"5.11-6","noFixRecorded":false,"fixedIn":null},{"text":"5.12-3:beta","noFixRecorded":false,"fixedIn":null},{"text":"5.12-4:beta","noFixRecorded":false,"fixedIn":null},{"text":"5.12-6:beta","noFixRecorded":false,"fixedIn":null},{"text":"5.12-7:beta","noFixRecorded":false,"fixedIn":null},{"text":"5.12-8:beta","noFixRecorded":false,"fixedIn":null},{"text":"5.13-1","noFixRecorded":false,"fixedIn":null},{"text":"5.13-2","noFixRecorded":false,"fixedIn":null},{"text":"5.14-2:beta","noFixRecorded":false,"fixedIn":null},{"text":"5.14-5:beta","noFixRecorded":false,"fixedIn":null},{"text":"5.15-1","noFixRecorded":false,"fixedIn":null},{"text":"5.16-1:beta","noFixRecorded":false,"fixedIn":null},{"text":"5.16-4:beta","noFixRecorded":false,"fixedIn":null},{"text":"5.16-5:beta","noFixRecorded":false,"fixedIn":null},{"text":"5.16-7:beta","noFixRecorded":false,"fixedIn":null},{"text":"5.16-8:beta","noFixRecorded":false,"fixedIn":null},{"text":"5.16.6:beta","noFixRecorded":false,"fixedIn":null},{"text":"5.17-1","noFixRecorded":false,"fixedIn":null},{"text":"5.17-2","noFixRecorded":false,"fixedIn":null},{"text":"5.17-3","noFixRecorded":false,"fixedIn":null},{"text":"5.17-4","noFixRecorded":false,"fixedIn":null},{"text":"5.17-5:beta","noFixRecorded":false,"fixedIn":null},{"text":"5.17-6","noFixRecorded":false,"fixedIn":null},{"text":"5.18-1:beta","noFixRecorded":false,"fixedIn":null},{"text":"5.18-2:beta","noFixRecorded":false,"fixedIn":null},{"text":"5.19-1:production","noFixRecorded":false,"fixedIn":null},{"text":"5.20-1:beta","noFixRecorded":false,"fixedIn":null},{"text":"5.20-2:beta","noFixRecorded":false,"fixedIn":null},{"text":"5.20-3:beta","noFixRecorded":false,"fixedIn":null},{"text":"5.20-5:beta","noFixRecorded":false,"fixedIn":null},{"text":"5.20-6:beta","noFixRecorded":false,"fixedIn":null},{"text":"5.20-7:beta","noFixRecorded":false,"fixedIn":null},{"text":"5.20-8:beta","noFixRecorded":false,"fixedIn":null},{"text":"5.20-9:beta","noFixRecorded":false,"fixedIn":null},{"text":"5.21-1:production","noFixRecorded":false,"fixedIn":null},{"text":"5.21-2:production","noFixRecorded":false,"fixedIn":null},{"text":"5.22-1:beta","noFixRecorded":false,"fixedIn":null}],"versionsText":"3.10 | 3.11 | 3.12 | 3.13 | 3.20 | 3.51 | 3.52 | 3.53 | 3.54 | 3.55 | 3.56-2 | 3.57 | 3.58 | 3.59 | 3.60 | 3.61 | 3.62 | 3.63 | 3.64 | 3.65 | 3.70-2 | 3.71 | 3.72 | 3.73 | 3.74 | 3.75 | 3.90 | 3.91 | 3.92 | 3.93 | 3.94 | 4.00 | 4.01 | 4.02 | 4.03-3 | 4.05-2 | 4.06-2 | 4.07-1 | 4.08-4 | 4.09-1 | 4.10-4 | 4.10-5 | 4.11-1 | 4.11-2 | 4.11-3 | 4.11-4 | 4.11-5 | 4.11-7 | 4.11-8 | 4.11-9 | 4.11-10 | 4.11-11 | 4.11-12 | 4.11-13 | 4.11-14 | 4.12-5 | 4.12-6 | 4.13-1 | 4.20-2 | 4.20-3 | 4.20-5 | 4.20-6 | 4.20-7 | 4.25-3 | 4.27-1 | 4.27-2 | 4.27-4 | 4.27-5 | 4.27-6 | 4.27-7 | 4.28-1 | 4.28-2 | 5.00-1 | 5.00-2 | 5.01-5 | 5.02-5 | 5.03-1 | 5.04-7 | 5.09-13 | 5.10-1 | 5.10-2 | 5.11-1 | 5.11-2 | 5.11-3 | 5.11-4 | 5.11-5 | 5.11-6 | 5.12-3:beta | 5.12-4:beta | 5.12-6:beta | 5.12-7:beta | 5.12-8:beta | 5.13-1 | 5.13-2 | 5.14-2:beta | 5.14-5:beta | 5.15-1 | 5.16-1:beta | 5.16-4:beta | 5.16-5:beta | 5.16-7:beta | 5.16-8:beta | 5.16.6:beta | 5.17-1 | 5.17-2 | 5.17-3 | 5.17-4 | 5.17-5:beta | 5.17-6 | 5.18-1:beta | 5.18-2:beta | 5.19-1:production | 5.20-1:beta | 5.20-2:beta | 5.20-3:beta | 5.20-5:beta | 5.20-6:beta | 5.20-7:beta | 5.20-8:beta | 5.20-9:beta | 5.21-1:production | 5.21-2:production | 5.22-1:beta","eol":null,"hubHref":"/vendor/zend/zendto"}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://zend.to/changelog.php","label":"zend.to/changelog.php","hostname":"zend.to","tags":["X Refsource MISC","Release Notes","Vendor Advisory"]},{"url":"http://jul.es/pipermail/zendto/2020-January/003845.html","label":"jul.es/pipermail/zendto/2020-January/003845.html","hostname":"jul.es","tags":["X Refsource MISC","Third Party Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2020-03-24T20:12:07.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-04T10:19:19.710Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":30,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T14:03:31.697Z","stale":false,"partial":false}}