Vulnerability CVE-2023-2897


Published: 2023-06-09

Description:
The Brizy Page Builder plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.4.18. This is due to an implicit trust of user-supplied IP addresses in an 'X-Forwarded-For' HTTP header for the purpose of validating allowed IP addresses against a Maintenance Mode whitelist. Supplying a whitelisted IP address within the 'X-Forwarded-For' header allows maintenance mode to be bypassed and may result in the disclosure of potentially sensitive information or allow access to restricted functionality.

Type:

CWE-348

(Use of Less Trusted Source)

 References:
https://www.wordfence.com/threat-intel/vulnerabilities/id/ae342dd9-2f5f-4356-8fb4-9a3e5f4f8316?source=cve
https://plugins.trac.wordpress.org/changeset/2919443/brizy

Copyright 2024, cxsecurity.com

 

Back to Top