CVE-2019-17240
40Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 3.7epss 40%
from disclosure to weapon246 days
Published on NVDOct 6
1st PoC+246d
exploitation probability
40%top 2% of all CVEs
observed exploitation
nono source reports it
13 public exploit(s)
bl-kernel/security.class.php in Bludit 3.9.2 allows attackers to bypass a brute-force protection mechanism by using many different forged X-Forwarded-For or Client-IP HTTP headers.
CVSS:3.0/AC:H/AV:N/A:N/C:L/I:N/PR:N/S:U/UI:N
Affected products
n/a · n/apublic PoCs found — 13
githubgithub.com/pingport80/CVE-2019-17240★ 3githubgithub.com/ColdFusionX/CVE-2019-17240_Bludit-BF-Bypass★ 2githubgithub.com/spyx/cve-2019-17240★ 1githubgithub.com/0xDTC/Bludit-3.9.2-Auth-Bruteforce-Bypass-CVE-2019-17240★ 1githubgithub.com/triple-octopus/Bludit-CVE-2019-17240-Fork★ 0githubgithub.com/jayngng/bludit-CVE-2019-17240★ 0githubgithub.com/brunosergi/bloodit★ 0githubgithub.com/mind2hex/CVE-2019-17240-Bludit-3.9.2-Auth-Bruteforce-Bypass★ 0githubgithub.com/LucaReggiannini/Bludit-3-9-2-bb★ 0exploitdbwww.exploit-db.com/exploits/48942unverifiedcve_referencepacketstormsecurity.com/files/159664/Bludit-3.9.2-Bruteforce-Mitigation-Bypass.htmlunverifiedcve_referencepacketstormsecurity.com/files/158875/Bludit-3.9.2-Authentication-Bruteforce-Mitigation-Bypass.htmlunverifiedexploitdbwww.exploit-db.com/exploits/48746unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
http://packetstormsecurity.com/files/158875/Bludit-3.9.2-Authentication-Bruteforce-Mitigation-Bypass.htmlhttp://packetstormsecurity.com/files/159664/Bludit-3.9.2-Bruteforce-Mitigation-Bypass.htmlhttps://github.com/bludit/bludit/pull/1090https://rastating.github.io/bludit-brute-force-mitigation-bypass/