The Brizy Page Builder plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.4.18. This is due to an implicit trust of user-supplied IP addresses in an 'X-Forwarded-For' HTTP header for the purpose of validating allowed IP addresses against a Maintenance Mode whitelist. Supplying a whitelisted IP address within the 'X-Forwarded-For' header allows maintenance mode to be bypassed and may result in the disclosure of potentially sensitive information or allow access to restricted functionality.
References
Configurations
History
21 Nov 2024, 07:59
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://plugins.trac.wordpress.org/changeset/2919443/brizy - Patch | |
| References | () https://www.wordfence.com/threat-intel/vulnerabilities/id/ae342dd9-2f5f-4356-8fb4-9a3e5f4f8316?source=cve - Third Party Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 3.7 |
15 Jun 2023, 22:17
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://www.wordfence.com/threat-intel/vulnerabilities/id/ae342dd9-2f5f-4356-8fb4-9a3e5f4f8316?source=cve - Third Party Advisory | |
| References | (MISC) https://plugins.trac.wordpress.org/changeset/2919443/brizy - Patch | |
| CPE | cpe:2.3:a:brizy:brizy:*:*:*:*:*:wordpress:*:* | |
| CWE | CWE-345 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.3 |
09 Jun 2023, 07:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-06-09 07:15
Updated : 2024-11-21 07:59
NVD link : CVE-2023-2897
Mitre link : CVE-2023-2897
CVE.ORG link : CVE-2023-2897
JSON object : View
Products Affected
brizy
- brizy
CWE
CWE-345
Insufficient Verification of Data Authenticity