PT-2012-6161 · WordPress+1 · Wordpress+1

Published 2012-12-27 · Updated 2013-01-08 · CVE-2012-5868

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions WordPress version 3.4.2

Description The issue allows remote attackers to discover valid session identifiers via a brute-force attack or modify data via a replay attack because the wordpress sec session cookie is not invalidated upon an administrator's logout action.

Recommendations For WordPress version 3.4.2, as a temporary workaround, consider implementing additional security measures to protect against session replay attacks, such as restricting access to sensitive areas of the site or using a web application firewall to detect and prevent brute-force attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2012-5868

Affected Products

Debian

Wordpress

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2012-5868 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-5868 · Vendor Advisory
• https://ubuntu.com/security/CVE-2012-5868 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2012-5868 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2012-5868 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/wordpress · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5868 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2012-5868 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2012-5868 · Vendor Advisory
• http://whiteoaksecurity.com/blog/2012/12/17/cve-2012-5868-wordpress-342-sessions-not-terminated-upon-explicit-user-logout · Note
• https://packages.debian.org/src:wordpress · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5868 · Note