CVE-2014-9037
published 2014-11-25CVE-2014-9037: WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to obtain access to an account idle since…
PriorityP431medium6.8CVSS 2.0
AVNACMAuNCPIPAP
EPSS
2.57%
83.5th percentile
WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to obtain access to an account idle since 2008 by leveraging an improper PHP dynamic type comparison for an MD5 hash.
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | wordpress | < wordpress 4.0.1+dfsg-1 (bookworm) | wordpress 4.0.1+dfsg-1 (bookworm) |
| mageia_project | mageia | — | — |
| mageia_project | mageia | — | — |
| wordpress | wordpress | <= 3.7.4 | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | >= 0 < 4.0.1+dfsg-1 | 4.0.1+dfsg-1 |
| wordpress | wordpress | >= 0 < 4.0.1+dfsg-1 | 4.0.1+dfsg-1 |
| wordpress | wordpress | >= 0 < 4.0.1+dfsg-1 | 4.0.1+dfsg-1 |
| wordpress | wordpress | >= 0 < 4.0.1+dfsg-1 | 4.0.1+dfsg-1 |
CVSS provenance
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv6.8MEDIUM
vendor_debian6.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-f6m5-cxjc-8qwq: WordPress before 3
ghsa_unreviewed·2022-05-17
CVE-2014-9037 [MEDIUM] GHSA-f6m5-cxjc-8qwq: WordPress before 3
WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to obtain access to an account idle since 2008 by leveraging an improper PHP dynamic type comparison for an MD5 hash.
OSV
CVE-2014-9037: WordPress before 3
osv·2014-11-25·CVSS 6.8
CVE-2014-9037 [MEDIUM] CVE-2014-9037: WordPress before 3
WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to obtain access to an account idle since 2008 by leveraging an improper PHP dynamic type comparison for an MD5 hash.
Debian
CVE-2014-9037: wordpress - WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4...
vendor_debian·2014·CVSS 6.8
CVE-2014-9037 [MEDIUM] CVE-2014-9037: wordpress - WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4...
WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to obtain access to an account idle since 2008 by leveraging an improper PHP dynamic type comparison for an MD5 hash.
Scope: local
bookworm: resolved (fixed in 4.0.1+dfsg-1)
bullseye: resolved (fixed in 4.0.1+dfsg-1)
forky: resolved (fixed in 4.0.1+dfsg-1)
sid: resolved (fixed in 4.0.1+dfsg-1)
trixie: resolved (fixed in 4.0.1+dfsg-1)
No detection rules found.
No public exploits indexed.
http://advisories.mageia.org/MGASA-2014-0493.htmlhttp://openwall.com/lists/oss-security/2014/11/25/12http://www.debian.org/security/2014/dsa-3085http://www.mandriva.com/security/advisories?name=MDVSA-2014:233http://www.securitytracker.com/id/1031243https://wordpress.org/news/2014/11/wordpress-4-0-1/http://advisories.mageia.org/MGASA-2014-0493.htmlhttp://openwall.com/lists/oss-security/2014/11/25/12http://www.debian.org/security/2014/dsa-3085http://www.mandriva.com/security/advisories?name=MDVSA-2014:233http://www.securitytracker.com/id/1031243https://wordpress.org/news/2014/11/wordpress-4-0-1/
2014-11-25
Published