The Brizy Page Builder plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.4.18. This is due to an implicit trust of user-supplied IP addresses in an 'X-Forwarded-For' HTTP header for the purpose of validating allowed IP addresses against a Maintenance Mode whitelist. Supplying a whitelisted IP address within the 'X-Forwarded-For' header allows maintenance mode to be bypassed and may result in the disclosure of potentially sensitive information or allow access to restricted functionality.
References
Link | Resource |
---|---|
https://plugins.trac.wordpress.org/changeset/2919443/brizy | Patch |
https://www.wordfence.com/threat-intel/vulnerabilities/id/ae342dd9-2f5f-4356-8fb4-9a3e5f4f8316?source=cve | Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: Wordfence
Published: 2023-06-09T06:48:49.496Z
Updated: 2023-06-09T06:48:49.496Z
Reserved: 2023-05-25T17:46:23.832Z
Link: CVE-2023-2897
JSON object: View
NVD Information
Status : Modified
Published: 2023-06-09T07:15:10.423
Modified: 2023-11-07T04:13:30.290
Link: CVE-2023-2897
JSON object: View
Redhat Information
No data.
CWE