CVE-2024-0787: Improper Restriction of Excessive Authentication Attempts in phpipam/phpipam
phpIPAM version 1.5.1 contains a vulnerability where an attacker can bypass the IP block mechanism to brute force passwords for users by using the 'X-Forwarded-For' header. The issue lies in the 'getuserip()' function in 'class.Common.php' at lines 1044 and 1045, where the presence of the 'X-Forwarded-For' header is checked and used instead of 'REMOTEADDR'. This vulnerability allows attackers to perform brute force attacks on user accounts, including the admin account. The issue is fixed in version 1.7.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-0787?
CVE-2024-0787 is classified as a high severity vulnerability due to its potential for unauthorized access and brute force password attacks.
How do I fix CVE-2024-0787?
To fix CVE-2024-0787, update phpIPAM to version 1.7.0 or later, which contains the necessary security patches.
What types of attacks can be executed using CVE-2024-0787?
CVE-2024-0787 can be exploited to bypass the IP block mechanism, allowing attackers to perform brute force attacks on user passwords.
Which versions of phpIPAM are affected by CVE-2024-0787?
phpIPAM versions prior to 1.7.0 are affected by CVE-2024-0787 and should be updated to mitigate the vulnerability.
Where is the vulnerability located in the phpIPAM codebase for CVE-2024-0787?
CVE-2024-0787 is located in the 'get_user_ip()' function within 'class.Common.php' at lines 1044 and 1045.