Description

WordPress is prone to multiple username enumeration weaknesses because it displays different responses to requests depending on whether or not the username exists. Attackers may exploit these weaknesses to discern valid usernames, which may aid them in brute-force password cracking or other attacks. WordPress versions prior to 2.8.1 are vulnerable.

Remediation

Update to WordPress version 2.8.1 or latest

References

http://www.coresecurity.com/content/WordPress-Privileges-Unchecked

http://www.exploit-db.com/exploits/9110/

http://www.securityfocus.com/archive/1/504795

Related Vulnerabilities

Oracle Database Server Other Vulnerability (CVE-2002-1767)

WordPress Plugin SS Quiz Multiple Unspecified Vulnerabilities (1.12)

Python Integer Overflow or Wraparound Vulnerability (CVE-2008-3143)

WordPress Plugin 0mk Shortener Cross-Site Request Forgery (0.2)

WordPress Plugin Mobile Domain Multiple Vulnerabilities (1.5.2)

Severity

High

Classification

CVE-2009-2335 CVE-2009-2336 CWE-16 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update