CVE-2022-2368: 
PHP vulnerability analysis and mitigation

Authentication Bypass by Spoofing vulnerability was identified in GitHub repository microweber/microweber prior to version 1.2.20. The vulnerability was discovered and disclosed on July 11, 2022, and was assigned identifier CVE-2022-2368 (CVE Details).

The vulnerability allows an attacker to bypass authentication by spoofing user headers such as HTTP_X_FORWARDED or HTTP_CLIENT_IP. The issue was addressed by implementing additional server-side validation using REMOTE_ADDR to prevent authentication bypass attempts (GitHub Commit).

This vulnerability could potentially allow unauthorized access to protected resources through authentication bypass, compromising the security of the affected systems running Microweber versions prior to 1.2.20.

The vulnerability can be exploited by manipulating HTTP headers related to client identification, specifically by spoofing HTTP_X_FORWARDED or HTTP_CLIENT_IP headers to bypass authentication mechanisms (Huntr Report).

The vulnerability was patched in Microweber version 1.2.20. The fix includes additional server-side validation using REMOTE_ADDR to prevent authentication bypass attempts. Users should upgrade to version 1.2.20 or later to address this security issue (GitHub Commit).