CVE-2008-4106 — Improper Input Validation in Wordpress

CWE-20 — Improper Input Validation6 documents6 sources
Severity
5.1MEDIUMNVD
EPSS
14.6%
top 5.50%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
WordpressDebian Wordpress
Timeline
PublishedSep 18
Latest updateMay 2

Description

WordPress before 2.6.2 does not properly handle MySQL warnings about insertion of username strings that exceed the maximum column width of the user_login column, and does not properly handle space characters when comparing usernames, which allows remote attackers to change an arbitrary user's password to a random value by registering a similar username and then requesting a password reset, related to a "SQL column truncation vulnerability." NOTE: the attacker can discover the random password by …

CVSS vector

AV:N/AC:H/C:P/I:P/A:PExploitability: 4.9 | Impact: 6.4

Affected Packages3 packages

▶debiandebian/wordpress< wordpress 2.5.1-8 (bookworm)
▶Debianwordpress/wordpress< 2.5.1-8+3
▶NVDwordpress/wordpress2.6.1+33

Patches

Patch: wordpress.org ↗Patch: wordpress.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-gg7f-mrmc-j93p: WordPress before 2↗2022-05-02
▶
OSV
CVE-2008-4106: WordPress before 2↗2008-09-18
▶

📋Vendor Advisories

2
Red Hat
wordpress: sql column truncation flaw↗2008-09-11
▶
Debian
CVE-2008-4106: wordpress - WordPress before 2.6.2 does not properly handle MySQL warnings about insertion o...↗2008
▶

💬Community

1
Bugzilla
CVE-2008-4106 wordpress: sql column truncation flaw↗2008-09-18
▶
CVE-2008-4106 — Improper Input Validation in Wordpress | cvebase