WordPress CVEs

Description

wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error messages for requests lacking a dbname parameter depending on whether the MySQL credentials are valid, which makes it easier for remote attackers to conduct brute-force attacks via a series of requests with different uname and pwd parameters. NOTE: the vendor disputes the significance of this issue; also, it is unclear whether providing intentionally vague error messages during installation would be reasonable from a usability perspective

Affected WordPress components

• WordPress core
  Confirmed match
  Up to and including 3.3.1; Version 0.7; Version 0.71; Version 0.72; Version 0.711; Version 1.0; Version 1.0.1; Version 1.0.2; Version 1.2; Version 1.2.1; Version 1.2.2; Version 1.5; Version 1.5.1; Version 1.5.1.2; Version 1.5.1.3; Version 1.5.2; Version 2.0; Version 2.0.1; Version 2.0.2; Version 2.0.3; Version 2.0.4; Version 2.0.5; Version 2.0.6; Version 2.0.7; Version 2.0.8; Version 2.0.9; Version 2.0.10; Version 2.0.11; Version 2.1; Version 2.1.1; Version 2.1.2; Version 2.1.3; Version 2.2; Version 2.2.1; Version 2.2.2; Version 2.2.3; Version 2.3; Version 2.3.1; Version 2.3.2; Version 2.3.3; Version 2.5; Version 2.5.1; Version 2.6; Version 2.6.1; Version 2.6.2; Version 2.6.3; Version 2.6.5; Version 2.7; Version 2.7.1; Version 2.8; Version 2.8.1; Version 2.8.2; Version 2.8.3; Version 2.8.4; Version 2.8.5; Version 2.8.6; Version 2.9; Version 2.9.1; Version 2.9.2; Version 3.0; Version 3.0.1; Version 3.0.2; Version 3.0.3; Version 3.0.4; Version 3.0.5; Version 3.0.6; Version 3.1; Version 3.1.1; Version 3.1.2; Version 3.1.3; Version 3.1.4; Version 3.2.1; Version 3.3

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• n/a n/a — Versions not specified
• wordpress wordpress — Up to and including 3.3.1
• wordpress wordpress — Version 0.7
• wordpress wordpress — Version 0.71
• wordpress wordpress — Version 0.72
• wordpress wordpress — Version 0.711
• wordpress wordpress — Version 1.0
• wordpress wordpress — Version 1.0.1
• wordpress wordpress — Version 1.0.2
• wordpress wordpress — Version 1.2
• wordpress wordpress — Version 1.2.1
• wordpress wordpress — Version 1.2.2
• wordpress wordpress — Version 1.5
• wordpress wordpress — Version 1.5.1
• wordpress wordpress — Version 1.5.1.2
• wordpress wordpress — Version 1.5.1.3
• wordpress wordpress — Version 1.5.2
• wordpress wordpress — Version 2.0
• wordpress wordpress — Version 2.0.1
• wordpress wordpress — Version 2.0.2
• wordpress wordpress — Version 2.0.3
• wordpress wordpress — Version 2.0.4
• wordpress wordpress — Version 2.0.5
• wordpress wordpress — Version 2.0.6
• wordpress wordpress — Version 2.0.7
• wordpress wordpress — Version 2.0.8
• wordpress wordpress — Version 2.0.9
• wordpress wordpress — Version 2.0.10
• wordpress wordpress — Version 2.0.11
• wordpress wordpress — Version 2.1
• wordpress wordpress — Version 2.1.1
• wordpress wordpress — Version 2.1.2
• wordpress wordpress — Version 2.1.3
• wordpress wordpress — Version 2.2
• wordpress wordpress — Version 2.2.1
• wordpress wordpress — Version 2.2.2
• wordpress wordpress — Version 2.2.3
• wordpress wordpress — Version 2.3
• wordpress wordpress — Version 2.3.1
• wordpress wordpress — Version 2.3.2
• wordpress wordpress — Version 2.3.3
• wordpress wordpress — Version 2.5
• wordpress wordpress — Version 2.5.1
• wordpress wordpress — Version 2.6
• wordpress wordpress — Version 2.6.1
• wordpress wordpress — Version 2.6.2
• wordpress wordpress — Version 2.6.3
• wordpress wordpress — Version 2.6.5
• wordpress wordpress — Version 2.7
• wordpress wordpress — Version 2.7.1
• wordpress wordpress — Version 2.8
• wordpress wordpress — Version 2.8.1
• wordpress wordpress — Version 2.8.2
• wordpress wordpress — Version 2.8.3
• wordpress wordpress — Version 2.8.4
• wordpress wordpress — Version 2.8.5
• wordpress wordpress — Version 2.8.6
• wordpress wordpress — Version 2.9
• wordpress wordpress — Version 2.9.1
• wordpress wordpress — Version 2.9.2
• wordpress wordpress — Version 3.0
• wordpress wordpress — Version 3.0.1
• wordpress wordpress — Version 3.0.2
• wordpress wordpress — Version 3.0.3
• wordpress wordpress — Version 3.0.4
• wordpress wordpress — Version 3.0.5
• wordpress wordpress — Version 3.0.6
• wordpress wordpress — Version 3.1
• wordpress wordpress — Version 3.1.1
• wordpress wordpress — Version 3.1.2
• wordpress wordpress — Version 3.1.3
• wordpress wordpress — Version 3.1.4
• wordpress wordpress — Version 3.2.1
• wordpress wordpress — Version 3.3

References

• archives.neohapsis.com http://archives.neohapsis.com/archives/bugtraq/2012-01/0150.html Exploit
• www.exploit-db.com http://www.exploit-db.com/exploits/18417 Exploit
• www.trustwave.com https://www.trustwave.com/spiderlabs/advisories/TWSL2012-002.txt Exploit
• nvd.nist.gov Official NVD record