{"id":"CVE-2019-17240","details":"bl-kernel/security.class.php in Bludit 3.9.2 allows attackers to bypass a brute-force protection mechanism by using many different forged X-Forwarded-For or Client-IP HTTP headers.","modified":"2026-08-07T15:18:09.998672Z","published":"2019-10-06T19:15:09.377Z","references":[{"type":"WEB","url":"http://packetstormsecurity.com/files/158875/Bludit-3.9.2-Authentication-Bruteforce-Mitigation-Bypass.html"},{"type":"WEB","url":"http://packetstormsecurity.com/files/159664/Bludit-3.9.2-Bruteforce-Mitigation-Bypass.html"},{"type":"EVIDENCE","url":"https://github.com/bludit/bludit/pull/1090"},{"type":"EVIDENCE","url":"https://rastating.github.io/bludit-brute-force-mitigation-bypass/"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/bludit/bludit","events":[{"introduced":"b1fc6cd0be012c038af7ad83ed2209bf7e976f88"},{"last_affected":"b1fc6cd0be012c038af7ad83ed2209bf7e976f88"}],"database_specific":{"extracted_events":[{"introduced":"3.9.2"},{"last_affected":"3.9.2"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:bludit:bludit:3.9.2:*:*:*:*:*:*:*"}}],"versions":["3.9.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-17240.json"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}