Description
The Knock Knock plugin before 1.2.8 for Craft CMS allows IP Whitelist bypass via an X-Forwarded-For HTTP header.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | verbb/knock-knock | < 1.2.8 | 1.2.8 | GHSA-wxvr-qqm7-6h65 |
Critical · 9.1
CVE-2020-13485
EUVD-2022-5675GHSA-wxvr-qqm7-6h65
Knock Knock plugin IP Whitelist bypass via an X-Forwarded-For HTTP header
Published May 25, 2020 · Updated Aug 4, 2024 · Assigned by mitre