9.8
CVE-2020-35590
- EPSS 42.85%
- Veröffentlicht 21.12.2020 07:15:14
- Zuletzt bearbeitet 21.11.2024 05:27:39
- Quelle cve@mitre.org
- CVE-Watchlists
- Unerledigt
LoginLimit Login Attempts Reloaded <= 2.17.3 - Login Rate Limiting Bypass
LimitLoginAttempts.php in the limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows a bypass of (per IP address) rate limits because the X-Forwarded-For header can be forged. When the plugin is configured to accept an arbitrary header for the client source IP address, a malicious user is not limited to perform a brute force attack, because the client IP header accepts any arbitrary string. When randomizing the header input, the login count does not ever reach the maximum allowed retries.
Mögliche Gegenmaßnahme
Limit Login Attempts Reloaded – Login Security, Brute Force Protection, Firewall: Update to version 2.17.4, or a newer patched version
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt
Limit Login Attempts Reloaded – Login Security, Brute Force Protection, Firewall
Version
*-2.17.3
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Limitloginattempts ≫ Limit Login Attempts Reloaded SwPlatformwordpress Version < 2.17.4
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 42.85% | 0.973 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 9.8 | 3.9 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
| nvd@nist.gov | 5 | 10 | 2.9 |
AV:N/AC:L/Au:N/C:P/I:N/A:N
|
CWE-307 Improper Restriction of Excessive Authentication Attempts
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.