Medium severity · published Dec 12, 2022
CVE-2022-4097
All In One WP Security & Firewall < 5.0.8 - IP Spoofing
5.3
CVSS
0.6%
EPSS
No
On KEV
Description
The All-In-One Security (AIOS) WordPress plugin before 5.0.8 is susceptible to IP Spoofing attacks, which can lead to bypassed security features (like IP blocks, rate limiting, brute force protection, and more).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
All-in-one Security · Updraftplus
before 5.0.8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-4097
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-4097
Exploit
https://wpscan.com/vulnerability/15819d33-7497-4f7d-bbb8-b3ab147806c4
More from All-in-one Security
6.1
CVE-2024-1037
All-In-One Security (AIOS) – Security and Firewall <= 5.2.5 - Reflected Cross-Site Scripting
5.3
CVE-2022-4346
All In One WP Security & Firewall < 5.1.3 - Configuration Leak
4.9
CVE-2023-0156
All-In-One Security (AIOS) < 5.1.5 - Admin+ Arbitrary File/Folder Access via Traversal
4.8
CVE-2023-0157
All-In-One Security (AIOS) < 5.1.5 - Admin+ Stored XSS