CVE-2007-0109 — Improper Control of Interaction Frequency in Wordpress

5 documents5 sources

Severity

5.0MEDIUMNVD

EPSS

1.4%

top 19.62%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Wordpress Debian Wordpress

Timeline

PublishedJan 9

Latest updateMay 1

Description

wp-login.php in WordPress 2.0.5 and earlier displays different error messages if a user exists or not, which allows remote attackers to obtain sensitive information and facilitates brute force attacks.

CVSS vector

AV:N/AC:L/C:P/I:N/A:NExploitability: 10.0 | Impact: 2.9

Affected Packages3 packages

▶debiandebian/wordpress< wordpress 2.0.6-1 (bookworm)

▶Debianwordpress/wordpress< 2.0.6-1+3

▶NVDwordpress/wordpress6 versions+5

🔴Vulnerability Details

GHSA

GHSA-x6vh-35h2-cm67: wp-login↗2022-05-01

▶

OSV

CVE-2007-0109: wp-login↗2007-01-09

▶

📋Vendor Advisories

Debian

CVE-2007-0109: wordpress - wp-login.php in WordPress 2.0.5 and earlier displays different error messages if...↗2007

▶

💬Community

Bugzilla

CVE-2007-0{106,107,109,262}: Wordpress < 2.0.7 multiple vulnerabilities↗2007-01-17

▶