CVE-2024-54450

An issue was discovered in Kurmi Provisioning Suite 7.9.0.33. If an X-Forwarded-For header is received during authentication, the Kurmi application will record the (possibly forged) IP address mentioned in that header rather than the real IP address that the user logged in from. This fake IP address can later be displayed in the My Account popup that shows the IP address that was used to log in.

• CWE-290

• https://kurmi-software.com
• https://kurmi-software.com/cve/cve-2024-54450/

Published

Dec 27, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-54445Login functionality contains a blind SQL injection that can …8.7
• CVE-2024-54446Document history functionality contains a blind SQL injectio…7.1
• CVE-2024-54447Saved search functionality contains a blind SQL injection th…7.1
• CVE-2024-54448The Automation Scripting functionality can be exploited by a…7.2
• CVE-2024-54449The API used to interact with documents in the application c…8.8
• CVE-2024-5445Ecosystem Agent version 4 < 4.1.5.2597 and Ecosystem Agent v…3.8
• CVE-2024-54451A cross-site scripting (XSS) vulnerability in the graphicCus…4.8
• CVE-2024-54452An issue was discovered in Kurmi Provisioning Suite before 7…4.9
• CVE-2024-54453An issue was discovered in Kurmi Provisioning Suite before 7…7.5
• CVE-2024-54454An issue was discovered in Kurmi Provisioning Suite before 7…5.3
• CVE-2024-54455In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-54456In the Linux kernel, the following vulnerability has been re…7.8