CVE-2020-1755: 
NixOS vulnerability analysis and mitigation

In Moodle before versions 3.8.2, 3.7.5, 3.6.9, and 3.5.11, a vulnerability was discovered where X-Forwarded-For headers could be used to spoof a user's IP address, enabling bypass of remote address checks. The vulnerability was assigned CVE-2020-1755 and was reported by Brendan Heywood (Moodle Advisory).

The vulnerability is classified with a CVSS v3.1 Base Score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. The issue stems from insufficient verification of data authenticity (CWE-345) in the handling of X-Forwarded-For headers, which could allow attackers to manipulate IP address information (NVD).

The vulnerability allows malicious actors to spoof their IP addresses, potentially bypassing IP-based security controls and remote address checks. This could lead to unauthorized access and compromise of IP-based security mechanisms (Moodle Advisory).

The vulnerability can be exploited remotely without requiring privileges or user interaction. The attack complexity is rated as low, indicating relatively straightforward exploitation (NVD).

The vulnerability was patched in Moodle versions 3.8.2, 3.7.5, 3.6.9, and 3.5.11. For proper functionality after applying the patch, sites using multiple levels of reverse proxies/balancers that append to the X-Forwarded-For header need to configure the new 'reverseproxyignore' setting to ensure accurate IP checking and logging (Moodle Advisory).