WordPress CVEs

Description

wp-login.php in WordPress 2.0.5 and earlier displays different error messages if a user exists or not, which allows remote attackers to obtain sensitive information and facilitates brute force attacks.

Affected WordPress components

• WordPress core
  Confirmed match
  Version 2.0; Version 2.0.1; Version 2.0.2; Version 2.0.3; Version 2.0.4; Version 2.0.5

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• n/a n/a — Versions not specified
• wordpress wordpress — Version 2.0
• wordpress wordpress — Version 2.0.1
• wordpress wordpress — Version 2.0.2
• wordpress wordpress — Version 2.0.3
• wordpress wordpress — Version 2.0.4
• wordpress wordpress — Version 2.0.5

References

• osvdb.org http://osvdb.org/31577
• secunia.com http://secunia.com/advisories/23621 Vendor Advisory
• secunia.com http://secunia.com/advisories/23741
• security.gentoo.org http://security.gentoo.org/glsa/glsa-200701-10.xml
• securityreason.com http://securityreason.com/securityalert/2113
• www.securityfocus.com http://www.securityfocus.com/archive/1/455927/100/0/threaded
• www.vupen.com http://www.vupen.com/english/advisories/2007/0062
• exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/31262
• nvd.nist.gov Official NVD record