NVD

Id
1866  
Name
CVE-2008-1930  
Description
The cookie authentication method in WordPress 2.5 relies on a hash of a concatenated string containing USERNAME and EXPIRY_TIME, which allows remote attackers to forge cookies by registering a username that results in the same concatenated string, as demonstrated by registering usernames beginning with "admin" to obtain administrator privileges, aka a "cryptographic splicing" issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2007-6013.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-03  
Published
2008-04-28  
Modified Date
2011-03-07  
Seq
2008-1930  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
12068 1866 CVE-2008-1930 http://wordpress.org/development/2008/04/wordpress-251/  View
12069 1866 CVE-2008-1930 http://www.cl.cam.ac.uk/users/sjm217/advisories/wordpress-cookie-integrity.txt  View
12070 1866 CVE-2008-1930 20080425 Wordpress 2.5 Cookie Integrity Protection Vulnerability  View
12071 1866 CVE-2008-1930 28935  View
12072 1866 CVE-2008-1930 1019923  View
12073 1866 CVE-2008-1930 ADV-2008-1372  View
12074 1866 CVE-2008-1930 wordpress-cookie-security-bypass(42027)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
50408 JVNDB-2008-005718 WordPress のクッキー認証メソッドにおけるクッキーを偽造される脆弱性 WordPress のクッキー認証メソッドは、USERNAME および EXPIRY_TIME を含む連結した文字列のハッシュに依存するため、クッキーを偽造される脆弱性が存在します。 CVE-2008-1930 32043 CVE-2008-1930 1866 7.5 http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-005718.html 2008-04-25 2012-12-20 View