V
Scaner-VS
HomeCatalogSourcesCWECAPECATT&CKMitigationsProductsVendorsDocs
CVE-2020-35590
CVE
CriticalConfirmedExploit available

LimitLoginAttempts.php in the limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows a bypass of (per IP address) rate lim…

CVSS
9.8
Critical
EPSS
0.04
p89
Published
2020-01-01
Updated
2020-01-01
Description

LimitLoginAttempts.php in the limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows a bypass of (per IP address) rate limits because the X-Forwarded-For header can be forged. When the plugin is configured to accept an arbitrary header for the client source IP address, a malicious user is not limited to perform a brute force attack, because the client IP header accepts any arbitrary string. When randomizing the header input, the login count does not ever reach the maximum allowed retries.

Tags · CWE
Pre-auth
CWE-307
CAPEC-16
CAPEC-49
CAPEC-560
CAPEC-565
CAPEC-600
CAPEC-652
CAPEC-653
Affected products
Limit_login_attempts_reloaded < 2.17.4
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Timeline
2020-01-01
Published
2020-01-01
Updated
CVSS 3.1 breakdown
Attack Vector
AV: N
Network (N)
Attack Complexity
AC: L
Low (L)
Privileges Required
PR: N
None (N)
User Interaction
UI: N
None (N)
Scope
S: U
Unchanged (U)
Confidentiality Impact
C: H
High (H)
Integrity Impact
I: H
High (H)
Availability Impact
A: H
High (H)
Exploit indicators
EPSS
0.043 · p89
Known exploited (KEV)
No
MITRE ATT&CK
Inferred via CAPEC
└ via CAPEC-560 · CWE-307
└ via CAPEC-49 · CWE-307
└ via CAPEC-565 · CWE-307
└ via CAPEC-600 · CWE-307
└ via CAPEC-652 · CWE-307
Known exploits — Сканер-ВС
CVE-2020-35590
github-poc · https://github.com/N4nj0/CVE-2020-35590
Enterprise
Affected products
ProductVendorStatus
limit_login_attempts_reloaded*Tracked
Source databases
CVE