CVE-2023-45132

NAXSI is an open-source maintenance web application firewall (WAF) for NGINX. An issue present starting in version 1.3 and prior to version 1.6 allows someone to bypass the WAF when a malicious `X-Forwarded-For` IP matches `IgnoreIP` `IgnoreCIDR` rules. This old code was arranged to allow older NGINX versions to also support `IgnoreIP` `IgnoreCIDR` when multiple reverse proxies were present. The issue is patched in version 1.6. As a workaround, do not set any `IgnoreIP` `IgnoreCIDR` for older versions.

• CWE-693

• https://github.com/wargio/naxsi/commit/1b712526ed3314dd6be7e8b0259eabda63c19537Patch
• https://github.com/wargio/naxsi/pull/103Patch
• https://github.com/wargio/naxsi/security/advisories/GHSA-7qjc-q4j9-pc8xThird Party Advisory
• https://github.com/wargio/naxsi/commit/1b712526ed3314dd6be7e8b0259eabda63c19537Patch
• https://github.com/wargio/naxsi/pull/103Patch
• https://github.com/wargio/naxsi/security/advisories/GHSA-7qjc-q4j9-pc8xThird Party Advisory

Published

Oct 11, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-45127Rejected reason: It is a duplicate.
• CVE-2023-45128Fiber is an express inspired web framework written in Go. A …8.8
• CVE-2023-45129Synapse is an open-source Matrix homeserver written and main…4.9
• CVE-2023-4513BT SDP dissector memory leak in Wireshark 4.0.0 to 4.0.7 and…7.5
• CVE-2023-45130Frontier is Substrate's Ethereum compatibility layer. Prior …7.5
• CVE-2023-45131Discourse is an open source platform for community discussio…7.5
• CVE-2023-45133Babel is a compiler for writingJavaScript. In `@babel/traver…8.8
• CVE-2023-45134XWiki Platform is a generic wiki platform offering runtime s…9
• CVE-2023-45135XWiki Platform is a generic wiki platform offering runtime s…8
• CVE-2023-45136XWiki Platform is a generic wiki platform offering runtime s…9.6
• CVE-2023-45137XWiki Platform is a generic wiki platform offering runtime s…5.4
• CVE-2023-45138Change Request is an pplication allowing users to request ch…9.6