CVE-2014-9037

WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to obtain access to an account idle since 2008 by leveraging an improper PHP dynamic type comparison for an MD5 hash.

CVSS v2.0 6.8 MEDIUM

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://advisories.mageia.org/MGASA-2014-0493.html
http://openwall.com/lists/oss-security/2014/11/25/12
http://www.debian.org/security/2014/dsa-3085
http://www.mandriva.com/security/advisories?name=MDVSA-2014:233
http://www.securitytracker.com/id/1031243
https://wordpress.org/news/2014/11/wordpress-4-0-1/	Vendor Advisory Patch

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:mageia_project:mageia:3:::::::*
	cpe:2.3:o:mageia_project:mageia:4:::::::*

Configuration 2 (hide)

OR	cpe:2.3:a:wordpress:wordpress::::::::
	cpe:2.3:a:wordpress:wordpress:3.8:::::::*
	cpe:2.3:a:wordpress:wordpress:3.8.1:::::::*
	cpe:2.3:a:wordpress:wordpress:3.8.2:::::::*
	cpe:2.3:a:wordpress:wordpress:3.8.3:::::::*
	cpe:2.3:a:wordpress:wordpress:3.8.4:::::::*
	cpe:2.3:a:wordpress:wordpress:3.9:::::::*
	cpe:2.3:a:wordpress:wordpress:3.9.1:::::::*
	cpe:2.3:a:wordpress:wordpress:3.9.2:::::::*
	cpe:2.3:a:wordpress:wordpress:4.0:::::::*

Configuration 3 (hide)

OR	cpe:2.3:o:debian:debian_linux:7.0:::::::*
	cpe:2.3:o:debian:debian_linux:8.0:::::::*

History

No history.

Information

Published : 2014-11-25 23:59

Updated : 2016-06-30 16:58

NVD link : CVE-2014-9037

Mitre link : CVE-2014-9037

CVE.ORG link : CVE-2014-9037

JSON object : View

Products Affected

debian

debian_linux

mageia_project

mageia

wordpress

wordpress

CWE

CWE-310

Cryptographic Issues

{"id": "CVE-2014-9037", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2014-11-25T23:59:08.193", "references": [{"url": "http://advisories.mageia.org/MGASA-2014-0493.html", "source": "cve@mitre.org"}, {"url": "http://openwall.com/lists/oss-security/2014/11/25/12", "source": "cve@mitre.org"}, {"url": "http://www.debian.org/security/2014/dsa-3085", "source": "cve@mitre.org"}, {"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:233", "source": "cve@mitre.org"}, {"url": "http://www.securitytracker.com/id/1031243", "source": "cve@mitre.org"}, {"url": "https://wordpress.org/news/2014/11/wordpress-4-0-1/", "tags": ["Vendor Advisory", "Patch"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-310"}]}], "descriptions": [{"lang": "en", "value": "WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to obtain access to an account idle since 2008 by leveraging an improper PHP dynamic type comparison for an MD5 hash."}, {"lang": "es", "value": "WordPress anterior a 3.7.5, 3.8.x anterior a 3.8.5, 3.9.x anterior a 3.9.3, y 4.x anterior a 4.0.1 podr\u00eda permitir a atacantes remotos obtener el acceso a una cuenta ociosa desde el 2008 mediante el aprovechamiento de una comparaci\u00f3n indebida del tipo din\u00e1mico de PHP para un hash MD5."}], "lastModified": "2016-06-30T16:58:39.460", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:mageia_project:mageia:3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F1911F9C-95A5-49DD-80F0-472BE92D7CDA"}, {"criteria": "cpe:2.3:o:mageia_project:mageia:4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EDB6C80D-ADCA-481E-B54B-3BEA3D7D3107"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "05E4FA51-9B8A-49E4-B6E8-A9799BE216CC", "versionEndIncluding": "3.7.4"}, {"criteria": "cpe:2.3:a:wordpress:wordpress:3.8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F4D38621-9941-4D03-91D7-3902930546A2"}, {"criteria": "cpe:2.3:a:wordpress:wordpress:3.8.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "934CC6A1-D5E4-468C-B31D-F5C7B02FCE6C"}, {"criteria": "cpe:2.3:a:wordpress:wordpress:3.8.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BC02EF96-4F17-443C-A739-961EED916C18"}, {"criteria": "cpe:2.3:a:wordpress:wordpress:3.8.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C631B472-8FF2-4A93-91F1-DCA813A8520A"}, {"criteria": "cpe:2.3:a:wordpress:wordpress:3.8.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "57EB9FD7-7922-44A5-BB82-410B33032E59"}, {"criteria": "cpe:2.3:a:wordpress:wordpress:3.9:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CC9343FA-182C-4E2E-85ED-13F0B398258A"}, {"criteria": "cpe:2.3:a:wordpress:wordpress:3.9.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B79DE40E-BFA7-43DA-AB42-2812FB207941"}, {"criteria": "cpe:2.3:a:wordpress:wordpress:3.9.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5EED9381-2BFC-4BDA-AC4B-CBC77E8538D4"}, {"criteria": "cpe:2.3:a:wordpress:wordpress:4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E372A3D2-FCB5-4A74-840D-EC03732FCC97"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "16F59A04-14CF-49E2-9973-645477EA09DA"}, {"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}