PT-2014-3511 · WordPress · Wordpress

Published 2014-04-09 · Updated 2017-12-16 · CVE-2014-0166

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 3.7.2 WordPress versions 3.8.x prior to 3.8.2

Description The issue concerns the wp validate auth cookie function in wp-includes/pluggable.php, which does not properly determine the validity of authentication cookies. This makes it easier for remote attackers to obtain access via a forged cookie.

Recommendations For WordPress versions prior to 3.7.2, update to version 3.7.2 or later. For WordPress versions 3.8.x prior to 3.8.2, update to version 3.8.2 or later.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2014-0166

DSA-2901-1

MGASA-2014-0254

Affected Products

Wordpress

References · 18

• 🔥 https://github.com/Ettack/POC-CVE-2014-0166 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-0166 · Security Note
• http://codex.wordpress.org/Version_3.8.2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-0166 · Vendor Advisory
• http://codex.wordpress.org/Version_3.7.2 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-0166 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-0166 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-0166 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-0166 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-0166 · Security Note
• https://advisories.mageia.org/MGASA-2014-0254.html · Security Note
• https://osv.dev/vulnerability/MGASA-2014-0254 · Vendor Advisory
• http://debian.org/security/2014/dsa-2901 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1085858 · Note
• http://mandriva.com/en/support/security/advisories/mbs1/MDVSA-2014:103 · Note