CVE-2024-0787

MEDIUM Year: 2024
CVSS v3 Score
5.3
Medium
Weakness Type
CWE-307
View all →

Vulnerability Description

phpIPAM version 1.5.1 contains a vulnerability where an attacker can bypass the IP block mechanism to brute force passwords for users by using the 'X-Forwarded-For' header. The issue lies in the 'get_user_ip()' function in 'class.Common.php' at lines 1044 and 1045, where the presence of the 'X-Forwarded-For' header is checked and used instead of 'REMOTE_ADDR'. This vulnerability allows attackers to perform brute force attacks on user accounts, including the admin account. The issue is fixed in version 1.7.0.

Related Vulnerabilities

CVE-2017-10604

MEDIUM
CVSS:5.3(Medium)

When the device is configured to perform account lockout with a defined period of time, any unauthenticated user attempting to log in as root with an incorrect password can trigger a lockout of the ro...

CWE-3072017

CVE-2018-16703

MEDIUM
CVSS:5.3(Medium)

A vulnerability in the Gleez CMS 1.2.0 login page could allow an unauthenticated, remote attacker to perform multiple user enumerations, which can further help an attacker to perform login attempts in...

CWE-3072018

CVE-2019-0039

MEDIUM
CVSS:5.3(Medium)

If REST API is enabled, the Junos OS login credentials are vulnerable to brute force attacks. The high default connection limit of the REST API may allow an attacker to brute-force passwords using adv...

CWE-3072019

CVE-2019-1126

MEDIUM
CVSS:5.3(Medium)

A security feature bypass vulnerability exists in Active Directory Federation Services (ADFS) which could allow an attacker to bypass the extranet lockout policy.To exploit this vulnerability, an atta...

CWE-3072019

CVE-2020-1616

MEDIUM
CVSS:5.3(Medium)

Due to insufficient server-side login attempt limit enforcement, a vulnerability in the SSH login service of Juniper Networks Juniper Advanced Threat Prevention (JATP) Series and Virtual JATP (vJATP) ...

CWE-3072020

CVE-2020-4232

MEDIUM
CVSS:5.3(Medium)

IBM Security Identity Governance and Intelligence 5.2.6 could allow an attacker to enumerate usernames to find valid login credentials which could be used to attempt further attacks against the system...

CWE-3072020