PatchTheCVECVE-2024-41432: An IP Spoofing vulnerability has been discovered in Likeshop up to 2.5.7.20210811
CVE-2024-41432 is a medium-severity flaw (CVSS 5.3) affecting likeshop. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
An IP Spoofing vulnerability has been discovered in Likeshop up to 2.5.7.20210811. This issue allows an attacker to replace their real IP address with any arbitrary IP address, specifically by adding a forged 'X-Forwarded' or 'Client-IP' header to requests. Exploiting IP spoofing, attackers can bypass account lockout mechanisms during attempts to log into admin accounts, spoof IP addresses in requests sent to the server, and impersonate IP addres
Why this priority
- Public exploit reference
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.3 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.4% (top 68%) |
| CISA exploited list | No |
| Weakness | CWE-290 |
| Published | 2024-08-07 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2024-41432?
likeshop: upgrade to newer than 2.5.7.20210811. Exact commands for each OS are on this page.
Is CVE-2024-41432 being exploited?
CVE-2024-41432 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2024-41432 affect?
CVE-2024-41432 affects likeshop. Severity is medium (CVSS 5.3). An IP Spoofing vulnerability has been discovered in Likeshop up to 2.5.7.20210811. This issue allows an attacker to replace their real IP address with any arbitrary IP address, specifically by adding a forged 'X-Forwarded' or 'Client-IP' he
How urgent is CVE-2024-41432?
Priority 36/100. Public exploit reference; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2024-5766 LOW 2.4 UPGRADE A vulnerability was found in Likeshop up to 2.5.7 and classified as problematic
- CVE-2024-34949 HIGH 8.2 UPGRADE SQL injection vulnerability in Likeshop before 2.5.7 allows attackers to run abitrary SQL commands via the fun
- CVE-2024-24028 MEDIUM 5.9 UPGRADE Server Side Request Forgery (SSRF) vulnerability in Likeshop before 2.5.7 allows attackers to view sensitive i
- CVE-2024-24027 HIGH 7.2 UPGRADE SQL Injection vulnerability in Likeshop before 2.5.7 allows attackers to run abitrary SQL commands via the fun
- CVE-2024-0352 HIGH 7.3 UPGRADE A vulnerability classified as critical was found in Likeshop up to 2.5.7.20210311