CVE-2024-41432: n/a
Source CVE Database V5
Not known to be exploited · CVSS 5.3 Medium.
Data as of 25 Oct 2026, 19:02 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 31% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Affects
- Likeshop up to 2.5.7.20210811
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 7 Aug 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.
What to do
AI-suggested
To mitigate CVE-2024-41432, organizations should implement strict validation and filtering of HTTP headers that indicate client IP addresses, such as 'X-Forwarded-For' and 'Client-IP'. This includes configuring web servers and application firewalls to only accept these headers from trusted proxy IP addresses and ignoring or sanitizing them when received directly from clients. Deploying a whitelist approach for trusted proxies can prevent attackers from injecting spoofed headers. Additionally, Likeshop administrators should review and enhance account lockout policies to incorporate multi-factor authentication (MFA) for admin accounts, reducing reliance on IP-based controls. Monitoring and logging should be improved to detect anomalous IP address usage patterns and repeated failed login attempts. If possible, update Likeshop to a version that addresses this vulnerability once available or apply vendor-provided patches. Network segmentation and limiting administrative access to known, secure IP ranges can further reduce exposure. Finally, educating security teams about this specific threat will help in early detection and response.
Description
An IP Spoofing vulnerability has been discovered in Likeshop up to 2.5.7.20210811. This issue allows an attacker to replace their real IP address with any arbitrary IP address, specifically by adding a forged 'X-Forwarded' or 'Client-IP' header to requests. Exploiting IP spoofing, attackers can bypass account lockout mechanisms during attempts to log into admin accounts, spoof IP addresses in requests sent to the server, and impersonate IP addresses that have logged into user accounts, etc.