The Brizy Page Builder plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.4.18. This is due to an implicit trust of user-supplied IP addresses in an 'X-Forwarded-For' HTTP header for the purpose of validating allowed IP addresses against a Maintenance Mode whitelist. Supplying a whitelisted IP address within the 'X-Forwarded-For' header allows maintenance mode to be bypassed and may result in the disclosure of potentially sensitive information or allow access to restricted functionality.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: Wordfence
Published: 2023-06-09T06:48:49.496Z
Updated: 2024-08-02T06:41:03.585Z
Reserved: 2023-05-25T17:46:23.832Z
Link: CVE-2023-2897
Vulnrichment
No data.
NVD
Status : Modified
Published: 2023-06-09T07:15:10.423
Modified: 2023-11-07T04:13:30.290
Link: CVE-2023-2897
Redhat
No data.