CVE-2025-66204

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-66204", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-11-24T23:01:29.677Z", "datePublished": "2025-12-08T23:50:58.647Z", "dateUpdated": "2025-12-09T16:03:59.128Z"}, "containers": {"cna": {"title": "WBCE CMS allows brute-force protection bypass using X-Forwarded-For header", "problemTypes": [{"descriptions": [{"cweId": "CWE-307", "lang": "en", "description": "CWE-307: Improper Restriction of Excessive Authentication Attempts", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-693", "lang": "en", "description": "CWE-693: Protection Mechanism Failure", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/WBCE/WBCE_CMS/security/advisories/GHSA-f676-f375-m7mw", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/WBCE/WBCE_CMS/security/advisories/GHSA-f676-f375-m7mw"}, {"name": "https://github.com/WBCE/WBCE_CMS/commit/3765baddf27f31bbbea9c0228c452268621b25e5", "tags": ["x_refsource_MISC"], "url": "https://github.com/WBCE/WBCE_CMS/commit/3765baddf27f31bbbea9c0228c452268621b25e5"}, {"name": "https://github.com/WBCE/WBCE_CMS/releases/tag/1.6.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/WBCE/WBCE_CMS/releases/tag/1.6.5"}], "affected": [{"vendor": "WBCE", "product": "WBCE_CMS", "versions": [{"version": ">= 1.6.4, < 1.6.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-12-08T23:50:58.647Z"}, "descriptions": [{"lang": "en", "value": "WBCE CMS is a content management system. Version 1.6.4 contains a brute-force protection bypass where an attacker can indefinitely reset the counter by modifying `X-Forwarded-For` on each request, gaining unlimited password guessing attempts, effectively bypassing all brute-force protection. The application fully trusts the `X-Forwarded-For` header without validating it or restricting its usage. This issue is fixed in version 1.6.5."}], "source": {"advisory": "GHSA-f676-f375-m7mw", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/WBCE/WBCE_CMS/security/advisories/GHSA-f676-f375-m7mw", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-09T14:18:12.951947Z", "id": "CVE-2025-66204", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-09T16:03:59.128Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-66204", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-09T14:18:12.951947Z"}}}], "references": [{"url": "https://github.com/WBCE/WBCE_CMS/security/advisories/GHSA-f676-f375-m7mw", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-09T14:18:15.248Z"}}], "cna": {"title": "WBCE CMS allows brute-force protection bypass using X-Forwarded-For header", "source": {"advisory": "GHSA-f676-f375-m7mw", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}], "affected": [{"vendor": "WBCE", "product": "WBCE_CMS", "versions": [{"status": "affected", "version": ">= 1.6.4, < 1.6.5"}]}], "references": [{"url": "https://github.com/WBCE/WBCE_CMS/security/advisories/GHSA-f676-f375-m7mw", "name": "https://github.com/WBCE/WBCE_CMS/security/advisories/GHSA-f676-f375-m7mw", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/WBCE/WBCE_CMS/commit/3765baddf27f31bbbea9c0228c452268621b25e5", "name": "https://github.com/WBCE/WBCE_CMS/commit/3765baddf27f31bbbea9c0228c452268621b25e5", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/WBCE/WBCE_CMS/releases/tag/1.6.5", "name": "https://github.com/WBCE/WBCE_CMS/releases/tag/1.6.5", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "WBCE CMS is a content management system. Version 1.6.4 contains a brute-force protection bypass where an attacker can indefinitely reset the counter by modifying `X-Forwarded-For` on each request, gaining unlimited password guessing attempts, effectively bypassing all brute-force protection. The application fully trusts the `X-Forwarded-For` header without validating it or restricting its usage. This issue is fixed in version 1.6.5."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-307", "description": "CWE-307: Improper Restriction of Excessive Authentication Attempts"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-693", "description": "CWE-693: Protection Mechanism Failure"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-12-08T23:50:58.647Z"}}}, "cveMetadata": {"cveId": "CVE-2025-66204", "state": "PUBLISHED", "dateUpdated": "2025-12-09T16:03:59.128Z", "dateReserved": "2025-11-24T23:01:29.677Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-12-08T23:50:58.647Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "WBCE_CMS", "vendor": "WBCE", "versions": [{"status": "affected", "version": ">= 1.6.4, < 1.6.5"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wbce:wbce_cms:*:*:*:*:*:*:*:*", "matchCriteriaId": "D38CBB88-838C-4D43-B04B-0923D07D2F08", "versionEndExcluding": "1.6.5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "WBCE CMS is a content management system. Version 1.6.4 contains a brute-force protection bypass where an attacker can indefinitely reset the counter by modifying `X-Forwarded-For` on each request, gaining unlimited password guessing attempts, effectively bypassing all brute-force protection. The application fully trusts the `X-Forwarded-For` header without validating it or restricting its usage. This issue is fixed in version 1.6.5."}, {"lang": "es", "value": "WBCE CMS es un sistema de gesti\u00f3n de contenidos. La versi\u00f3n 1.6.4 contiene una omisi\u00f3n de la protecci\u00f3n contra fuerza bruta donde un atacante puede restablecer indefinidamente el contador modificando 'X-Forwarded-For' en cada solicitud, obteniendo intentos ilimitados para adivinar contrase\u00f1as, eludiendo eficazmente toda la protecci\u00f3n contra fuerza bruta. La aplicaci\u00f3n conf\u00eda plenamente en el encabezado 'X-Forwarded-For' sin validarlo ni restringir su uso. Este problema se solucion\u00f3 en la versi\u00f3n 1.6.5."}], "id": "CVE-2025-66204", "lastModified": "2026-10-07T20:10:01.970", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-66204", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-09T14:18:12.951947Z", "version": "2.0.3"}}]}, "published": "2025-12-09T00:15:49.157", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/WBCE/WBCE_CMS/commit/3765baddf27f31bbbea9c0228c452268621b25e5"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/WBCE/WBCE_CMS/releases/tag/1.6.5"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/WBCE/WBCE_CMS/security/advisories/GHSA-f676-f375-m7mw"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/WBCE/WBCE_CMS/security/advisories/GHSA-f676-f375-m7mw"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-307"}, {"lang": "en", "value": "CWE-693"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-307"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"created": "2025-12-09T10:04:32.770041+00:00", "updated": "2025-12-09T10:04:32.770074+00:00", "vendors": ["wbce", "wbce$PRODUCT$wbce_cms"]}