CVE-2012-6707
published 2017-10-19CVE-2012-6707: WordPress through 4.8.2 uses a weak MD5-based password hashing algorithm, which makes it easier for attackers to determine cleartext values by leveraging…
PriorityP338high7.5CVSS 3.0
AVNACLPRNUINSUCHINAN
EPSS
1.11%
62.2th percentile
WordPress through 4.8.2 uses a weak MD5-based password hashing algorithm, which makes it easier for attackers to determine cleartext values by leveraging access to the hash values. NOTE: the approach to changing this may not be fully compatible with certain use cases, such as migration of a WordPress site from a web host that uses a recent PHP version to a different web host that uses PHP 5.2. These use cases are plausible (but very unlikely) based on statistics showing widespread deployment of WordPress with obsolete PHP versions.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | wordpress | < wordpress 6.8.1+dfsg1-1 (forky) | wordpress 6.8.1+dfsg1-1 (forky) |
| wordpress | wordpress | <= 4.8.2 | — |
| wordpress | wordpress | >= 0 < 6.8.1+dfsg1-1 | 6.8.1+dfsg1-1 |
| wordpress | wordpress | >= 0 < 6.8.1+dfsg1-1 | 6.8.1+dfsg1-1 |
CVSS provenance
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
osv7.5HIGH
vendor_debian7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-75fw-m5qw-hfx6: WordPress through 4
ghsa_unreviewed·2022-05-17
CVE-2012-6707 [HIGH] CWE-326 GHSA-75fw-m5qw-hfx6: WordPress through 4
WordPress through 4.8.2 uses a weak MD5-based password hashing algorithm, which makes it easier for attackers to determine cleartext values by leveraging access to the hash values. NOTE: the approach to changing this may not be fully compatible with certain use cases, such as migration of a WordPress site from a web host that uses a recent PHP version to a different web host that uses PHP 5.2. These use cases are plausible (but very unlikely) based on statistics showing widespread deployment of WordPress with obsolete PHP versions.
OSV
CVE-2012-6707: WordPress through 4
osv·2017-10-19·CVSS 7.5
CVE-2012-6707 [HIGH] CVE-2012-6707: WordPress through 4
WordPress through 4.8.2 uses a weak MD5-based password hashing algorithm, which makes it easier for attackers to determine cleartext values by leveraging access to the hash values. NOTE: the approach to changing this may not be fully compatible with certain use cases, such as migration of a WordPress site from a web host that uses a recent PHP version to a different web host that uses PHP 5.2. These use cases are plausible (but very unlikely) based on statistics showing widespread deployment of WordPress with obsolete PHP versions.
Debian
CVE-2012-6707: wordpress - WordPress through 4.8.2 uses a weak MD5-based password hashing algorithm, which ...
vendor_debian·2012·CVSS 7.5
CVE-2012-6707 [HIGH] CVE-2012-6707: wordpress - WordPress through 4.8.2 uses a weak MD5-based password hashing algorithm, which ...
WordPress through 4.8.2 uses a weak MD5-based password hashing algorithm, which makes it easier for attackers to determine cleartext values by leveraging access to the hash values. NOTE: the approach to changing this may not be fully compatible with certain use cases, such as migration of a WordPress site from a web host that uses a recent PHP version to a different web host that uses PHP 5.2. These use cases are plausible (but very unlikely) based on statistics showing widespread deployment of WordPress with obsolete PHP versions.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 6.8.1+dfsg1-1)
sid: resolved (fixed in 6.8.1+dfsg1-1)
trixie: resolved (fixed in 6.8.1+dfsg1-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2017-10-19
Published