9.8
CVE-2007-6013
- EPSS 3.28%
- Veröffentlicht 19.11.2007 21:46:00
- Zuletzt bearbeitet 16.06.2026 22:47:15
- Quelle cve@mitre.org
- CVE-Watchlists
- Unerledigt
LoginWordPress Core 1.5 - 2.3.1 - Authorization Bypass
Wordpress 1.5 through 2.3.1 uses cookie values based on the MD5 hash of a password MD5 hash, which allows attackers to bypass authentication by obtaining the MD5 hash from the user database, then generating the authentication cookie from that hash.
Mögliche Gegenmaßnahme
WordPress: Update to version 2.3.2, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Fedoraproject ≫ Fedora Version7
Fedoraproject ≫ Fedora Version8
Weitere Schwachstelleninformationen
SystemWordPress Core
≫
Produkt
WordPress
Version
1.5-2.3.1
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 3.28% | 0.868 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 9.8 | 3.9 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
| nvd@nist.gov | 6.8 | 8.6 | 6.4 |
AV:N/AC:M/Au:N/C:P/I:P/A:P
|
CWE-327 Use of a Broken or Risky Cryptographic Algorithm
The product uses a broken or risky cryptographic algorithm or protocol.
http://lists.grok.org.uk/pipermail/full-disclosure/2007-November/058576.html
http://osvdb.org/40801
http://secunia.com/advisories/27714
http://secunia.com/advisories/28310
http://securityreason.com/securityalert/3375
http://trac.wordpress.org/ticket/5367
http://www.cl.cam.ac.uk/~sjm217/advisories/wordpress-cookie-auth.txt
http://www.securityfocus.com/archive/1/483927/100/0/threaded
http://www.securitytracker.com/id?1018980
http://www.vupen.com/english/advisories/2007/3941
https://exchange.xforce.ibmcloud.com/vulnerabilities/38578
https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00079.html
https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00098.html
https://www.wordfence.com/threat-intel/vulnerabilities/id/e9ec79e5-9f02-4a73-9437-58821ca855ef