PT-2014-6344 · WordPress · Wordpress

Ivan Novikov · Published 2014-08-18 · Updated 2014-11-14 · CVE-2014-5205

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 3.9.2

Description The issue concerns a weakness in the CSRF token generation mechanism. Specifically, it does not properly use delimiters during the concatenation of action values and uid values, making it easier for remote attackers to bypass the CSRF protection mechanism via a brute-force attack.

Recommendations For versions prior to 3.9.2, update to version 3.9.2 or later to resolve the issue.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2014-5205

DLA-56-1

DSA-3001-1

Affected Products

Wordpress

References · 12

• https://security-tracker.debian.org/tracker/CVE-2014-5205 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-5205 · Security Note
• http://debian.org/security/2014/dsa-3001 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-5205 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-5205 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-5205 · Vendor Advisory
• https://wordpress.org/news/2014/08/wordpress-3-9-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-5205 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-5205 · Vendor Advisory
• http://openwall.com/lists/oss-security/2014/08/13/3 · Note
• https://core.trac.wordpress.org/changeset/29408 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5205 · Note