2 lines
3.1 KiB
JSON
2 lines
3.1 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"WP Cerber Security, Anti-spam & Malware Scan","vendor":"gioni","versions":[{"lessThanOrEqual":"9.4","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"},{"affectedData":[{"cpes":["cpe:2.3:a:gioni:wp_cerber_security:*:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"wp_cerber_security","vendor":"gioni","versions":[{"lessThanOrEqual":"9.4","status":"affected","version":"0","versionType":"custom"}]}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wpcerber:cerber_security_antispam_\\&_malware_scan:*:*:*:*:*:wordpress:*:*","matchCriteriaId":"A77FCACD-9E44-4A64-B57C-0DA6996A9F9D","versionEndExcluding":"9.5","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"The WP Cerber Security plugin for WordPress is vulnerable to IP Protection bypass in versions up to, and including 9.4 due to the plugin improperly checking for a visitor's IP address. This makes it possible for an attacker whose IP address has been blocked to bypass this control by setting the X-Forwarded-For: HTTP header to an IP Address that hasn't been blocked."},{"lang":"es","value":"El complemento WP Cerber Security para WordPress es vulnerable a la omisión de la protección de IP en versiones hasta la 9.4 incluida, debido a que el complemento comprueba incorrectamente la dirección IP de un visitante. Esto hace posible que un atacante cuya dirección IP haya sido bloqueada omita este control configurando el encabezado HTTP X-Forwarded-For: en una dirección IP que no haya sido bloqueada."}],"id":"CVE-2022-4100","lastModified":"2026-06-17T05:19:56.997","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"security@wordfence.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2022-4100","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2024-09-03T14:23:00.430901Z","version":"2.0.3"}}]},"published":"2024-08-31T09:15:03.720","references":[{"source":"security@wordfence.com","tags":["Patch"],"url":"https://plugins.trac.wordpress.org/changeset/2865322/wp-cerber/trunk/cerber-common.php"},{"source":"security@wordfence.com","tags":["Third Party Advisory"],"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03ccd474-42f4-4cbb-823e-93fe4db1bf80?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-693"}],"source":"security@wordfence.com","type":"Secondary"},{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
|