Typecho 1.3.0 Handler X-Forwarded-For authentication spoofing

Summaryinfo

A vulnerability classified as problematic has been found in Typecho 1.3.0. The impacted element is an unknown function of the component Handler Handler. The manipulation of the argument X-Forwarded-For leads to an unknown weakness. This vulnerability is listed as CVE-2024-35538. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability was found in Typecho 1.3.0. It has been rated as problematic. This issue affects some unknown processing of the component Handler Handler. The manipulation of the argument X-Forwarded-For with an unknown input leads to a unknown weakness. Using CWE to declare the problem leads to CWE-290. This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks. Impacted is integrity. The summary by CVE is:

Typecho v1.3.0 was discovered to contain a Client IP Spoofing vulnerability, which allows attackers to falsify their IP addresses by specifying an arbitrary IP as value of X-Forwarded-For or Client-Ip headers while performing HTTP requests.

The identification of this vulnerability is CVE-2024-35538 since 05/17/2024. The exploitation is known to be easy. The attack may be initiated remotely. Technical details of the vulnerability are known, but there is no available exploit.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• Typecho

Version

• 1.3.0

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion