Description

WordPress and WordPress MU before 2.8.1 exhibit different behavior for a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. NOTE: the vendor reportedly disputes the significance of this issue, indicating that the behavior exists for "user convenience."

Remediation

References

CVE-2009-2335

Related Vulnerabilities

Dot CMS Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2017-5876)

WordPress Plugin Mapplic-Custom Interactive Map Server-Side Request Forgery (6.1)

WordPress Plugin wordpress vertical image slider Multiple Vulnerabilities (1.0)

MySQL CVE-2016-3459 Vulnerability (CVE-2016-3459)

Apache HTTP Server Improper Authentication Vulnerability (CVE-2017-3167)

Severity

Medium

Classification

CVE-2009-2335

Tags

Missing Update Known Vulnerabilities