Brizy Page Builder <= 2.4.18 - IP Address Spoofing to Protection Mechanism Bypass
Published Jun 9, 2023
5.3
MEDIUMCVSS 3.1
EPSS 0.29%
Description
The Brizy Page Builder plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.4.18. This is due to an implicit trust of user-supplied IP addresses in an 'X-Forwarded-For' HTTP header for the purpose of validating allowed IP addresses against a Maintenance Mode whitelist. Supplying a whitelisted IP address within the 'X-Forwarded-For' header allows maintenance mode to be bypassed and may result in the disclosure of potentially sensitive information or allow access to restricted functionality.
Affected products
-
- Version 0StatusaffectedConstraints<=2.4.18
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Themefusecom | Brizy – Page Builder | unaffected |
|
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
References (3)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-34343 Advisory
- https://plugins.trac.wordpress.org/changeset/2919443/brizy Patch
- https://www.wordfence.com/threat-intel/vulnerabilities/id/ae342dd9-2f5f-4356-8fb4-9a3e5f4f8316?source=cve Third Party Advisory
| Link | Providers | Tags |
|---|---|---|
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-34343 | Advisory | |
| https://plugins.trac.wordpress.org/changeset/2919443/brizy | Patch | |
| https://www.wordfence.com/threat-intel/vulnerabilities/id/ae342dd9-2f5f-4356-8fb4-9a3e5f4f8316?source=cve | Third Party Advisory |
Change history (0)
No recorded changes yet.