CVE-2019-17240
CRITICAL 9.8EPSS 39.6%
bl-kernel/security.class.php in Bludit 3.9.2 allows attackers to bypass a brute-force protection mechanism by using many different forged X-Forwarded-For or Client-IP HTTP headers.
- CVSS v3.1
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS v3.0
- 3.7 LOW
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - CVSS v2.0
- 4.3 MEDIUM
AV:N/AC:M/Au:N/C:P/I:N/A:N - EPSS
- 39.60% chance of exploitation in the next 30 days, 99th percentile
- Published
- 2019-10-06
- Updated
- 2024-08-05
Proof-of-concept exploits (14)
- bludit/bludit/pull/1090
- https://rastating.github.io/bludit-brute-force-mitigation-bypass/
- 0xDTC/Bludit-3.9.2-Auth-Bruteforce-Bypass-CVE-2019-172401★ · 2025-01-11
- ColdFusionX/CVE-2019-17240_Bludit-BF-Bypass2★ · 2020-10-24
- LucaReggiannini/Bludit-3-9-2-bb0★ · 2020-06-24
- TikvahTerminator/BluditBruteforce0★ · 2020-06-07
- jayngng/bludit-CVE-2019-172400★ · 2021-03-22
- m4rm0k/CVE-2019-161130★ · 2020-10-03
- mind2hex/CVE-2019-172400★ · 2024-03-28
- mind2hex/CVE-2019-17240-Bludit-3.9.2-Auth-Bruteforce-Bypass0★ · 2024-03-28
- pingport80/CVE-2019-172403★ · 2020-09-25
- pwnd-root/exploits-and-stuff0★ · 2020-07-23
- spyx/cve-2019-172401★ · 2021-06-15
- triple-octopus/Bludit-CVE-2019-17240-Fork0★ · 2020-07-29