~ / search / GHSA-wxvr-qqm7-6h65

GHSA-wxvr-qqm7-6h65

Knock Knock plugin IP Whitelist bypass via an X-Forwarded-For HTTP header

Source: GitHub Advisory Database (reviewed) Critical CVE-2020-13485

Packages

EcosystemPackageAffectedFixed in
Packagist verbb/knock-knock < 1.2.8 1.2.8

Details

As written in the advisory (Markdown source, shown as plain text).

The Knock Knock plugin before 1.2.8 for Craft CMS allows IP Whitelist bypass via an X-Forwarded-For HTTP header.

References

External links from the advisory. They lead to third-party sites.