CVE-2005-2109 — Missing Initialization of a Variable in Wordpress

CWE-456 — Missing Initialization of a Variable5 documents5 sources
Severity
5.0MEDIUMNVD
EPSS
1.1%
top 22.14%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
WordpressDebian Wordpress
Timeline
PublishedJul 5
Latest updateMay 1

Description

wp-login.php in WordPress 1.5.1.2 and earlier allows remote attackers to change the content of the forgotten password e-mail message via the message variable, which is not initialized before use.

CVSS vector

AV:N/AC:L/C:N/I:P/A:NExploitability: 10.0 | Impact: 2.9

Affected Packages3 packages

▶debiandebian/wordpress< wordpress 1.5.1.3-1 (bookworm)
▶Debianwordpress/wordpress< 1.5.1.3-1+3
▶NVDwordpress/wordpress7 versions+6

Patches

Patch: secunia.com ↗Patch: secunia.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-wg35-4wvh-6g56: wp-login↗2022-05-01
▶
OSV
CVE-2005-2109: wp-login↗2005-07-05
▶

📋Vendor Advisories

1
Debian
CVE-2005-2109: wordpress - wp-login.php in WordPress 1.5.1.2 and earlier allows remote attackers to change ...↗2005
▶

📐Framework References

1
CWE
Missing Initialization of a Variable↗
▶
CVE-2005-2109 — Missing Initialization of a Variable | cvebase