PT-2014-3511 · WordPress · Wordpress

Publicado 2014-04-09 · Atualizado 2017-12-16 · CVE-2014-0166

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 3.7.2 WordPress versions 3.8.x prior to 3.8.2

Description The issue concerns the wp validate auth cookie function in wp-includes/pluggable.php, which does not properly determine the validity of authentication cookies. This makes it easier for remote attackers to obtain access via a forged cookie.

Recommendations For WordPress versions prior to 3.7.2, update to version 3.7.2 or later. For WordPress versions 3.8.x prior to 3.8.2, update to version 3.8.2 or later.

Exploit

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2014-0166

DSA-2901-1

MGASA-2014-0254

Produtos afetados

Wordpress

Referências · 18

• 🔥 https://github.com/Ettack/POC-CVE-2014-0166 · Exploit
• https://bugzilla.redhat.com/show_bug.cgi?id=1085858 · Nota
• http://mandriva.com/en/support/security/advisories/mbs1/MDVSA-2014:103 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-0166 · Nota de Segurança
• http://codex.wordpress.org/Version_3.8.2 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2014-0166 · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=13184 · Nota
• http://codex.wordpress.org/Version_3.7.2 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-0166 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2014-0166 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2014-0166 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-0166 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2014-0166 · Nota de Segurança
• https://advisories.mageia.org/MGASA-2014-0254.html · Nota de Segurança
• https://osv.dev/vulnerability/MGASA-2014-0254 · Aviso do Fabricante