Description

WordPress and WordPress MU before 2.8.1 exhibit different behavior for a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. NOTE: the vendor reportedly disputes the significance of this issue, indicating that the behavior exists for "user convenience."

Remediation

References

CVE-2009-2335

Related Vulnerabilities

Joomla! Core 1.7.0 Information Disclosure (1.7.0)

Moodle Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2015-3274)

XWiki Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2023-50723)

WordPress 3.9.x Multiple Vulnerabilities (3.9 - 3.9.36)

WordPress Plugin PHPFreeChat 'url' Parameter Cross-Site Scripting (0.2.8)

Severity

Medium

Classification

CVE-2009-2335

Tags

Missing Update Known Vulnerabilities