CVE-2019-17240

Name of the Vulnerable Software and Affected Versions Bludit versions 3.2.9 through 3.9.2

Description The issue allows attackers to bypass a brute-force protection mechanism by using many different forged X-Forwarded-For or Client-IP HTTP headers. This can be exploited by sending requests with varying X-Forwarded-For or Client-IP headers to the affected system.

Recommendations For versions 3.2.9 through 3.9.2, consider temporarily disabling the authentication mechanism that relies on the X-Forwarded-For or Client-IP headers until a patch is available. Restrict access to the security.class.php file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.