9.1

CVE-2022-1165

Exploit

Blackhole for Bad Bots <= 3.3.1 - Arbitrary IP Address Blocking via IP Spoofing

The Blackhole for Bad Bots WordPress plugin before 3.3.2 uses headers such as CF-CONNECTING-IP, CLIENT-IP etc to determine the IP address of requests hitting the blackhole URL, which allows them to be spoofed. This could result in blocking arbitrary IP addresses, such as legitimate/good search engine crawlers / bots. This could also be abused by competitors to cause damage related to visibility in search engines, can be used to bypass arbitrary blocks caused by this plugin, block any visitor or even the administrator and even more.
Mögliche Gegenmaßnahme
Blackhole for Bad Bots: Update to version 3.3.2, or a newer patched version
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Product Blackhole for Bad Bots
Version [*, 3.3.2)
Data is provided by the National Vulnerability Database (NVD)
Plugin-planet ≫ Blackhole For Bad Bots SwPlatformwordpress Version < 3.3.2
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.35% 0.566
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 9.1 3.9 5.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
nvd@nist.gov 6.4 10 4.9
AV:N/AC:L/Au:N/C:N/I:P/A:P
CWE-639 Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.