PT-2023-22057 · WordPress · Brizy – Page Builder
CVSS v3.1
5.3
Média
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Brizy Page Builder plugin for WordPress versions up to, and including, 2.4.18
Description
The issue arises from an implicit trust of user-supplied IP addresses in the
X-Forwarded-For HTTP header, which is used to validate allowed IP addresses against a Maintenance Mode whitelist. By supplying a whitelisted IP address within the X-Forwarded-For header, an attacker can bypass maintenance mode, potentially disclosing sensitive information or gaining access to restricted functionality.Recommendations
For versions up to, and including, 2.4.18, consider disabling the Maintenance Mode whitelist until a patch is available to prevent IP address spoofing. Restrict access to the
X-Forwarded-For HTTP header to minimize the risk of exploitation. Update to a version later than 2.4.18 when available.Correção
Insufficient Verification of Data Authenticity
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Brizy – Page Builder