CVE-2012-6707 — Inadequate Encryption Strength in Wordpress

CWE-326 — Inadequate Encryption StrengthCWE-328 — Use of Weak Hash5 documents5 sources
Severity
7.5HIGHNVD
EPSS
0.2%
top 60.19%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
WordpressDebian Wordpress
Timeline
PublishedOct 19
Latest updateMay 17

Description

WordPress through 4.8.2 uses a weak MD5-based password hashing algorithm, which makes it easier for attackers to determine cleartext values by leveraging access to the hash values. NOTE: the approach to changing this may not be fully compatible with certain use cases, such as migration of a WordPress site from a web host that uses a recent PHP version to a different web host that uses PHP 5.2. These use cases are plausible (but very unlikely) based on statistics showing widespread deployment of …

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶debiandebian/wordpress< wordpress 6.8.1+dfsg1-1 (forky)
▶Debianwordpress/wordpress< 6.8.1+dfsg1-1+1

Patches

Patch: core.trac.wordpress.org ↗Patch: core.trac.wordpress.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-75fw-m5qw-hfx6: WordPress through 4↗2022-05-17
▶
OSV
CVE-2012-6707: WordPress through 4↗2017-10-19
▶

📋Vendor Advisories

1
Debian
CVE-2012-6707: wordpress - WordPress through 4.8.2 uses a weak MD5-based password hashing algorithm, which ...↗2012
▶

📐Framework References

1
CWE
Use of Weak Hash↗
▶
CVE-2012-6707 — Inadequate Encryption Strength | cvebase