Description

Cross-site request forgery (CSRF) vulnerability in wp-login.php in WordPress 3.7.4, 3.8.4, 3.9.2, and 4.0 allows remote attackers to hijack the authentication of arbitrary users for requests that reset passwords.

Remediation

References

CVE-2014-9033

Related Vulnerabilities

WordPress 5.3.x Directory Traversal (5.3 - 5.3.17)

WordPress 4.0.x Multiple Vulnerabilities (4.0 - 4.0.12)

Drupal Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2011-3730)

Mailman Other Vulnerability (CVE-2002-0855)

TYPO3 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2008-6699)

Severity

Medium

Classification

CVE-2014-9033 CWE-352

Tags

Missing Update Known Vulnerabilities