CVE-2022-4533

Katalog CVE

CVSS 5.3 · Medium EPSS 0,22%

Kerentanan Use of Less Trusted Source pada devfelixmoira limit login attempts plus. Skor CVSS 3.1 5.3 (Medium) menurut wordfence.com.

Deskripsi (NVD)

The Limit Login Attempts Plus plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 1.1.0. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supply the X-Forwarded-For header with with a different IP Address that will be logged and can be used to bypass settings that may have blocked out an IP address or country from logging in.

Rincian

Terbit di NVD

19 September 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber wordfence.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-348: Use of Less Trusted Source
CWE-345: Insufficient Verification of Data Authenticity

EPSS (30 hari)

0,22% peluang dieksploitasi; lebih tinggi dari 11,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.wordfence.com/threat-intel/vulnerabilities/id/aec7b59f-1c8a-4403-b33b-c119bd96ad9d?source=cve advisory pihak ketiga
• https://plugins.trac.wordpress.org/browser/limit-login-attempts-plus/trunk/core/LimitLoginAttempts.php#L1043 issue tracking