Knock Knock plugin IP Whitelist bypass via an X-Forwarded-For HTTP header

CRÍTICO 9.1CVE-2020-13485 · GHSA-wxvr-qqm7-6h65 · Published 25/05/2020 · updated 17/06/2026

En resumen

CVE-2020-13485 es una vulnerabilidad CRÍTICO (CVSS 9.1) que afecta a verbb/knock-knock, knock knock (verbb).
Probabilidad de explotación en los próximos 30 días (EPSS): 1.4%, mayor que el 71.6% de las vulnerabilidades.
Solución: actualizar a 1.2.8 o posterior.

Package	Affected versions	Patched versions
verbb/knock-knock Packagist	`< 1.2.8`	`1.2.8`
knock knock verbb	`< 1.2.8`	`1.2.8`

The Knock Knock plugin before 1.2.8 for Craft CMS allows IP Whitelist bypass via an X-Forwarded-For HTTP header.

NVD description

The Knock Knock plugin before 1.2.8 for Craft CMS allows IP Whitelist bypass via an X-Forwarded-For HTTP header.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.