GHSA-9wqr-9787-p4rf
Microweber before 1.2.21 allows attacker to bypass IP detection to brute-force password
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | microweber/microweber | < 1.2.21 | 1.2.21 |
Details
As written in the advisory (Markdown source, shown as plain text).
In the login API, an IP address will by default be blocked when the user tries to login incorrectly more than 5 times. However, a bypass to this mechanism is possible by abusing a X-Forwarded-For header to bypass IP detection and perform a password brute-force. A patch for this issue is available in Microweber version 1.2.21.
References
External links from the advisory. They lead to third-party sites.