CVE-2024-3050 — Authentication Bypass by Spoofing in Site Reviews

CWE-290 — Authentication Bypass by Spoofing2 documents2 sources
Severity
9.1CRITICALNVD
EPSS
0.8%
top 26.70%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Geminilabs Site Reviews
Timeline
PublishedMay 29

Description

The Site Reviews WordPress plugin before 7.0.0 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to bypass IP-based blocking

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NExploitability: 3.9 | Impact: 5.2

Affected Packages1 packages

🔴Vulnerability Details

1
CVEList
Site Reviews < 7.0.0 - IP Spoofing↗2024-05-29
▶
CVE-2024-3050 — Authentication Bypass by Spoofing | cvebase