CVE-2023-4281
Last modified
CVE-2023-4281 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. This Activity Log WordPress plugin before 2.8.8 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to hide the source of malicious traffic.. EPSS estimates a 0.63% chance of exploitation in the next 30 days.
Description
This Activity Log WordPress plugin before 2.8.8 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to hide the source of malicious traffic.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Activity Log Project | Activity Log | < 2.8.8 |
References
- https://wpscan.com/vulnerability/f5ea6c8a-6b07-4263-a1be-dd033f078d49Exploit, Third Party Advisory
- https://wpscan.com/vulnerability/f5ea6c8a-6b07-4263-a1be-dd033f078d49Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-4281?
How severe is CVE-2023-4281?
How do I fix CVE-2023-4281?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-42804BigBlueButton is an open-source virtual classroom. BigBlueBu…5.3
- CVE-2023-42805quinn-proto is a state machine for the QUIC transport protoc…7.5
- CVE-2023-42806Hydra is the layer-two scalability solution for Cardano. Pri…6.5
- CVE-2023-42807Frappe LMS is an open source learning management system. In …9.8
- CVE-2023-42808Common Voice is the web app for Mozilla Common Voice, a plat…6.1
- CVE-2023-42809Redisson is a Java Redis client that uses the Netty framewor…8.8
- CVE-2023-42810systeminformation is a System Information Library for Node.J…9.8
- CVE-2023-42811aes-gcm is a pure Rust implementation of the AES-GCM. Starti…5.5
- CVE-2023-42812Galaxy is an open-source platform for FAIR data analysis. Pr…4.3
- CVE-2023-42813Kyverno is a policy engine designed for Kubernetes. A securi…5.3
- CVE-2023-42814Kyverno is a policy engine designed for Kubernetes. A securi…5.3
- CVE-2023-42815Kyverno is a policy engine designed for Kubernetes. A securi…5.3
Are you affected by CVE-2023-4281?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST