PT-2014-8803

CVE-2014-9033

Publicado

2014-11-25

Atualizado

2015-11-02

Descrição por

CVSS 2.0

6.8

Média

MétricasAV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WordPress versions 3.7.4, 3.8.4, 3.9.2, and 4.0

Description A cross-site request forgery (CSRF) issue exists, allowing remote attackers to hijack the authentication of arbitrary users for requests that reset passwords. This occurs in the wp-login.php file.

Recommendations For WordPress version 3.7.4, update to a version that includes the fix for this issue. For WordPress version 3.8.4, update to a version that includes the fix for this issue. For WordPress version 3.9.2, update to a version that includes the fix for this issue. For WordPress version 4.0, update to a version that includes the fix for this issue.

Explorabilidade

Correção

Impactos

Pesquisadores

Jouko Pynnonen

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-352: Cross-Site Request Forgery (CSRF)

Identificadores relacionados

CVE-2014-9033

DLA-236-1