NVD

Id
32954  
Name
CVE-2014-5205  
Description
wp-includes/pluggable.php in WordPress before 3.9.2 does not use delimiters during concatenation of action values and uid values in CSRF tokens, which makes it easier for remote attackers to bypass a CSRF protection mechanism via a brute-force attack.  
Reject
 
CVSS Version
2  
CVSS Score
6.8  
Severity
Medium  
CVSS Base Score
6.8  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2014-08-18  
Modified Date
2014-11-13  
Seq
2014-5205  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
172995 32954 CVE-2014-5205 [oss-security] 20140813 Re: WordPress 3.9.2 release - needs CVE"s  View
172996 32954 CVE-2014-5205 DSA-3001  View
172997 32954 CVE-2014-5205 https://core.trac.wordpress.org/changeset/29408  View
172998 32954 CVE-2014-5205 https://wordpress.org/news/2014/08/wordpress-3-9-2/  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
14972 JVNDB-2014-003847 WordPress の wp-includes/pluggable.php における CSRF 保護メカニズムを回避される脆弱性 WordPress の wp-includes/pluggable.php は、CSRF トークン内の action 値と uid 値の結合時に、区切り文字を使用しないため、CSRF 保護メカニズムを回避される脆弱性が存在します。 CVE-2014-5205 72494 CVE-2014-5205 32954 6.8 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-003847.html 2014-08-06 2014-08-19 View