CVEvulnerability
CVE-2017-14990
6.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2017-10-03
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 6.5 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 4.0 MEDIUM — AV:N/AC:L/Au:S/C:P/I:N/A:N
- Weaknesses
- CWE-312
Description
WordPress 4.8.2 stores cleartext wp_signups.activation_key values (but stores the analogous wp_users.user_activation_key values as hashes), which might make it easier for remote attackers to hijack unactivated user accounts by leveraging database read access (such as access gained through an unspecified SQL injection vulnerability).
Affected configurations
• wordpress wordpress 4.8.2
• debian debian linux 8.0
• debian debian linux 9.0
Related
Weakness · CWE (1)
- CWE-312 Cleartext Storage of Sensitive Information weakness
References
- http://www.securitytracker.com/id/1039554 Third Party Advisory, VDB Entry
- https://core.trac.wordpress.org/ticket/38474 Exploit, Issue Tracking, Third Party Advisory
- https://www.debian.org/security/2017/dsa-3997 Third Party Advisory
- http://www.securitytracker.com/id/1039554 Third Party Advisory, VDB Entry
- https://core.trac.wordpress.org/ticket/38474 Exploit, Issue Tracking, Third Party Advisory
- https://www.debian.org/security/2017/dsa-3997 Third Party Advisory