CVE-2020-35590

Katalog CVE

CVSS 9.8 · Critical EPSS 4,3%

Kerentanan Improper Restriction of Excessive Authentication Attempts pada limitloginattempts limit login attempts reloaded. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

LimitLoginAttempts.php in the limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows a bypass of (per IP address) rate limits because the X-Forwarded-For header can be forged. When the plugin is configured to accept an arbitrary header for the client source IP address, a malicious user is not limited to perform a brute force attack, because the client IP header accepts any arbitrary string. When randomizing the header input, the login count does not ever reach the maximum allowed retries.

Rincian

Terbit di NVD

21 Desember 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-307: Improper Restriction of Excessive Authentication Attempts

EPSS (30 hari)

4,3% peluang dieksploitasi; lebih tinggi dari 91,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://n4nj0.github.io/advisories/wordpress-plugin-limit-login-attempts-reloaded/ advisory pihak ketiga
• https://wordpress.org/plugins/limit-login-attempts-reloaded/#developers product · advisory pihak ketiga