-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper IP comparison (CWE-697) where the plugin trusted the X-Forwarded-For header without validation(). The changelog for 1.2.8 explicitly mentions fixing IP fetching to prevent header spoofing, indicating the whitelist check previously relied on untrusted headers. The service class handling access control (KnockKnockService) would contain the IP validation logic, making checkWhitelist the most likely vulnerable function. The high confidence comes from the direct correlation between the vulnerability description, CWE type, and the patch's focus on IP source correction.
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| verbb/knock-knock | composer | < 1.2.8 | 1.2.8 |
Ongoing coverage of React2Shell