Knock Knock plugin IP Whitelist bypass via an X-Forwarded-For HTTP header

CRÍTICO 9.1CVE-2020-13485 · GHSA-wxvr-qqm7-6h65 · Published 25/05/2020 · updated 17/06/2026

Em resumo

CVE-2020-13485 é uma vulnerabilidade CRÍTICO (CVSS 9.1) que afeta verbb/knock-knock, knock knock (verbb).
Chance de exploração nos próximos 30 dias (EPSS): 1.4%, maior que 71.6% das vulnerabilidades.
Correção: atualize para 1.2.8 ou posterior.

Package	Affected versions	Patched versions
verbb/knock-knock Packagist	`< 1.2.8`	`1.2.8`
knock knock verbb	`< 1.2.8`	`1.2.8`

The Knock Knock plugin before 1.2.8 for Craft CMS allows IP Whitelist bypass via an X-Forwarded-For HTTP header.

NVD description

The Knock Knock plugin before 1.2.8 for Craft CMS allows IP Whitelist bypass via an X-Forwarded-For HTTP header.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.