CVEvulnerability
CVE-2014-9037
6.8 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2014-11-25
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-310
Description
WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to obtain access to an account idle since 2008 by leveraging an improper PHP dynamic type comparison for an MD5 hash.
Affected configurations
• mageia project mageia 3
• mageia project mageia 4
• wordpress wordpress (<= 3.7.4)
• wordpress wordpress 3.8
• wordpress wordpress 3.8.1
• wordpress wordpress 3.8.2
• wordpress wordpress 3.8.3
• wordpress wordpress 3.8.4
• wordpress wordpress 3.9
• wordpress wordpress 3.9.1
• wordpress wordpress 3.9.2
• wordpress wordpress 4.0
• debian debian linux 7.0
• debian debian linux 8.0
Related
Weakness · not in database (1)
References
- http://advisories.mageia.org/MGASA-2014-0493.html advisories.mageia.org
- http://openwall.com/lists/oss-security/2014/11/25/12 openwall.com
- http://www.debian.org/security/2014/dsa-3085 www.debian.org
- http://www.mandriva.com/security/advisories?name=MDVSA-2014:233 www.mandriva.com
- http://www.securitytracker.com/id/1031243 www.securitytracker.com
- https://wordpress.org/news/2014/11/wordpress-4-0-1/ Patch, Vendor Advisory
- http://advisories.mageia.org/MGASA-2014-0493.html advisories.mageia.org
- http://openwall.com/lists/oss-security/2014/11/25/12 openwall.com
- http://www.debian.org/security/2014/dsa-3085 www.debian.org
- http://www.mandriva.com/security/advisories?name=MDVSA-2014:233 www.mandriva.com
- http://www.securitytracker.com/id/1031243 www.securitytracker.com
- https://wordpress.org/news/2014/11/wordpress-4-0-1/ Patch, Vendor Advisory