5

CVE-2011-4898

Exploit
wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error messages for requests lacking a dbname parameter depending on whether the MySQL credentials are valid, which makes it easier for remote attackers to conduct brute-force attacks via a series of requests with different uname and pwd parameters.  NOTE: the vendor disputes the significance of this issue; also, it is unclear whether providing intentionally vague error messages during installation would be reasonable from a usability perspective
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Wordpress ≫ Wordpress Version <= 3.3.1
Wordpress ≫ Wordpress Version 0.7
Wordpress ≫ Wordpress Version 0.71
Wordpress ≫ Wordpress Version 0.72
Wordpress ≫ Wordpress Version 0.711
Wordpress ≫ Wordpress Version 1.0
Wordpress ≫ Wordpress Version 1.0.1
Wordpress ≫ Wordpress Version 1.0.2
Wordpress ≫ Wordpress Version 1.2
Wordpress ≫ Wordpress Version 1.2.1
Wordpress ≫ Wordpress Version 1.2.2
Wordpress ≫ Wordpress Version 1.5
Wordpress ≫ Wordpress Version 1.5.1
Wordpress ≫ Wordpress Version 1.5.1.2
Wordpress ≫ Wordpress Version 1.5.1.3
Wordpress ≫ Wordpress Version 1.5.2
Wordpress ≫ Wordpress Version 2.0
Wordpress ≫ Wordpress Version 2.0.1
Wordpress ≫ Wordpress Version 2.0.2
Wordpress ≫ Wordpress Version 2.0.3
Wordpress ≫ Wordpress Version 2.0.4
Wordpress ≫ Wordpress Version 2.0.5
Wordpress ≫ Wordpress Version 2.0.6
Wordpress ≫ Wordpress Version 2.0.7
Wordpress ≫ Wordpress Version 2.0.8
Wordpress ≫ Wordpress Version 2.0.9
Wordpress ≫ Wordpress Version 2.0.10
Wordpress ≫ Wordpress Version 2.0.11
Wordpress ≫ Wordpress Version 2.1
Wordpress ≫ Wordpress Version 2.1.1
Wordpress ≫ Wordpress Version 2.1.2
Wordpress ≫ Wordpress Version 2.1.3
Wordpress ≫ Wordpress Version 2.2
Wordpress ≫ Wordpress Version 2.2.1
Wordpress ≫ Wordpress Version 2.2.2
Wordpress ≫ Wordpress Version 2.2.3
Wordpress ≫ Wordpress Version 2.3
Wordpress ≫ Wordpress Version 2.3.1
Wordpress ≫ Wordpress Version 2.3.2
Wordpress ≫ Wordpress Version 2.3.3
Wordpress ≫ Wordpress Version 2.5
Wordpress ≫ Wordpress Version 2.5.1
Wordpress ≫ Wordpress Version 2.6
Wordpress ≫ Wordpress Version 2.6.1
Wordpress ≫ Wordpress Version 2.6.2
Wordpress ≫ Wordpress Version 2.6.3
Wordpress ≫ Wordpress Version 2.6.5
Wordpress ≫ Wordpress Version 2.7
Wordpress ≫ Wordpress Version 2.7.1
Wordpress ≫ Wordpress Version 2.8
Wordpress ≫ Wordpress Version 2.8.1
Wordpress ≫ Wordpress Version 2.8.2
Wordpress ≫ Wordpress Version 2.8.3
Wordpress ≫ Wordpress Version 2.8.4
Wordpress ≫ Wordpress Version 2.8.5
Wordpress ≫ Wordpress Version 2.8.6
Wordpress ≫ Wordpress Version 2.9
Wordpress ≫ Wordpress Version 2.9.1
Wordpress ≫ Wordpress Version 2.9.2
Wordpress ≫ Wordpress Version 3.0
Wordpress ≫ Wordpress Version 3.0.1
Wordpress ≫ Wordpress Version 3.0.2
Wordpress ≫ Wordpress Version 3.0.3
Wordpress ≫ Wordpress Version 3.0.4
Wordpress ≫ Wordpress Version 3.0.5
Wordpress ≫ Wordpress Version 3.0.6
Wordpress ≫ Wordpress Version 3.1
Wordpress ≫ Wordpress Version 3.1.1
Wordpress ≫ Wordpress Version 3.1.2
Wordpress ≫ Wordpress Version 3.1.3
Wordpress ≫ Wordpress Version 3.1.4
Wordpress ≫ Wordpress Version 3.2.1
Wordpress ≫ Wordpress Version 3.3
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 9.55% 0.948
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:N/A:P
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

http://archives.neohapsis.com/archives/bugtraq/2012-01/0150.html
Exploit
http://www.exploit-db.com/exploits/18417
Exploit
https://www.trustwave.com/spiderlabs/advisories/TWSL2012-002.txt
Exploit