GHSA-9wqr-9787-p4rf

    Dashboard / Vulnerabilities / GHSA-9wqr-9787-p4rf

    GHSA-9wqr-9787-p4rf

    Published: 12 Jul 2022Last Modified: 16 Feb 2024
    Aliases:
    CVE-2022-2368

    Summary: Microweber before 1.2.21 allows attacker to bypass IP detection to brute-force password

    Details: In the login API, an IP address will by default be blocked when the user tries to login incorrectly more than 5 times. However, a bypass to this mechanism is possible by abusing a X-Forwarded-For header to bypass IP detection and perform a password brute-force. A patch for this issue is available in Microweber version 1.2.21.

    References: https://nvd.nist.gov/vuln/detail/CVE-2022-2368, https://github.com/microweber/microweber/commit/53c000ccd5602536e28b15d9630eb8261b04a302, https://github.com/microweber/microweber, https://huntr.dev/bounties/a9595eda-a5e0-4717-8d64-b445ef83f452

    Affected packages

    Package

    Name: microweber/microweber

    Purl: pkg:composer/microweber/microweber

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -1.2.21

    Affected versions

    0.9.346

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-9wqr-9787-p4rf | CVE-DB