5.3

CVE-2022-4100

WP Cerber Security <= 9.4 - IP Protection Bypass

WP Cerber Security <= 9.4 - IP Protection Bypass

The WP Cerber Security plugin for WordPress is vulnerable to IP Protection bypass in versions up to, and including 9.4 due to the plugin improperly checking for a visitor's IP address. This makes it possible for an attacker whose IP address has been blocked to bypass this control by setting the X-Forwarded-For: HTTP header to an IP Address that hasn't been blocked.
Mögliche Gegenmaßnahme
WP Cerber Security, Anti-spam & Malware Scan: Update to version 9.5, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Wpcerber ≫ Cerber Security Antispam & Malware Scan SwPlatformwordpress Version < 9.5
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt WP Cerber Security, Anti-spam & Malware Scan
Version *-9.4
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.35% 0.264
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security@wordfence.com 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE-693 Protection Mechanism Failure

The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

https://plugins.trac.wordpress.org/changeset/2865322/wp-cerber/trunk/cerber-common.php
Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/03ccd474-42f4-4cbb-823e-93fe4db1bf80?source=cve
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/03ccd474-42f4-4cbb-823e-93fe4db1bf80
Third Party Advisory