CVE-2007-0109
published 2007-01-09CVE-2007-0109: wp-login.php in WordPress 2.0.5 and earlier displays different error messages if a user exists or not, which allows remote attackers to obtain sensitive…
PriorityP417medium5CVSS 2.0
AVNACLAuNCPINAN
EPSS
3.14%
86.4th percentile
wp-login.php in WordPress 2.0.5 and earlier displays different error messages if a user exists or not, which allows remote attackers to obtain sensitive information and facilitates brute force attacks.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | wordpress | < wordpress 2.0.6-1 (bookworm) | wordpress 2.0.6-1 (bookworm) |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | >= 0 < 2.0.6-1 | 2.0.6-1 |
| wordpress | wordpress | >= 0 < 2.0.6-1 | 2.0.6-1 |
| wordpress | wordpress | >= 0 < 2.0.6-1 | 2.0.6-1 |
| wordpress | wordpress | >= 0 < 2.0.6-1 | 2.0.6-1 |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
osv5.0MEDIUM
vendor_debian5.0LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-x6vh-35h2-cm67: wp-login
ghsa_unreviewed·2022-05-01
CVE-2007-0109 [MEDIUM] GHSA-x6vh-35h2-cm67: wp-login
wp-login.php in WordPress 2.0.5 and earlier displays different error messages if a user exists or not, which allows remote attackers to obtain sensitive information and facilitates brute force attacks.
OSV
CVE-2007-0109: wp-login
osv·2007-01-09·CVSS 5.0
CVE-2007-0109 [MEDIUM] CVE-2007-0109: wp-login
wp-login.php in WordPress 2.0.5 and earlier displays different error messages if a user exists or not, which allows remote attackers to obtain sensitive information and facilitates brute force attacks.
Debian
CVE-2007-0109: wordpress - wp-login.php in WordPress 2.0.5 and earlier displays different error messages if...
vendor_debian·2007·CVSS 5.0
CVE-2007-0109 [MEDIUM] CVE-2007-0109: wordpress - wp-login.php in WordPress 2.0.5 and earlier displays different error messages if...
wp-login.php in WordPress 2.0.5 and earlier displays different error messages if a user exists or not, which allows remote attackers to obtain sensitive information and facilitates brute force attacks.
Scope: local
bookworm: resolved (fixed in 2.0.6-1)
bullseye: resolved (fixed in 2.0.6-1)
forky: resolved (fixed in 2.0.6-1)
sid: resolved (fixed in 2.0.6-1)
trixie: resolved (fixed in 2.0.6-1)
No detection rules found.
No public exploits indexed.
http://osvdb.org/31577http://secunia.com/advisories/23621http://secunia.com/advisories/23741http://security.gentoo.org/glsa/glsa-200701-10.xmlhttp://securityreason.com/securityalert/2113http://www.securityfocus.com/archive/1/455927/100/0/threadedhttp://www.vupen.com/english/advisories/2007/0062https://exchange.xforce.ibmcloud.com/vulnerabilities/31262http://osvdb.org/31577http://secunia.com/advisories/23621http://secunia.com/advisories/23741http://security.gentoo.org/glsa/glsa-200701-10.xmlhttp://securityreason.com/securityalert/2113http://www.securityfocus.com/archive/1/455927/100/0/threadedhttp://www.vupen.com/english/advisories/2007/0062https://exchange.xforce.ibmcloud.com/vulnerabilities/31262
2007-01-09
Published