NVD

Id
3964  
Name
CVE-2008-4106  
Description
WordPress before 2.6.2 does not properly handle MySQL warnings about insertion of username strings that exceed the maximum column width of the user_login column, and does not properly handle space characters when comparing usernames, which allows remote attackers to change an arbitrary user"s password to a random value by registering a similar username and then requesting a password reset, related to a "SQL column truncation vulnerability." NOTE: the attacker can discover the random password by also exploiting CVE-2008-4107.  
Reject
 
CVSS Version
2  
CVSS Score
5.1  
Severity
Medium  
CVSS Base Score
5.1  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
4.9  
CVSS Vector
(AV:N/AC:H/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-03  
Published
2008-09-18  
Modified Date
2011-03-07  
Seq
2008-4106  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
25246 3964 CVE-2008-4106 [oss-security] 20080916 Re: CVE request: wordpress < 2.6.2  View
25247 3964 CVE-2008-4106 4272  View
25248 3964 CVE-2008-4106 1020869  View
25249 3964 CVE-2008-4106 http://wordpress.org/development/2008/09/wordpress-262/  View
25250 3964 CVE-2008-4106 DSA-1871  View
25251 3964 CVE-2008-4106 6397  View
25252 3964 CVE-2008-4106 6421  View
25253 3964 CVE-2008-4106 [oss-security] 20080911 CVE request: wordpress < 2.6.2  View
25254 3964 CVE-2008-4106 20080911 Advisory 05/2008: Wordpress user_login Column SQL Truncation Vulnerability  View
25255 3964 CVE-2008-4106 31068  View
25256 3964 CVE-2008-4106 http://www.sektioneins.de/advisories/SE-2008-05.txt  View
25257 3964 CVE-2008-4106 http://www.suspekt.org/2008/08/18/mysql-and-sql-column-truncation-vulnerabilities/  View
25258 3964 CVE-2008-4106 ADV-2008-2553  View
25259 3964 CVE-2008-4106 FEDORA-2008-7760  View
25260 3964 CVE-2008-4106 FEDORA-2008-7902  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
50911 JVNDB-2008-006221 WordPress におけるユーザパスワードを任意の値に変更される脆弱性 WordPress は、user_login 列の最大列幅を超えるユーザ名の文字列を挿入する際に MySQL 警告を適切に処理しない、およびユーザ名を比較するの際にスペース文字を適切に処理しない、および "SQL の列短縮の脆弱性" の不備があるため、ユーザパスワードを任意の値に変更される脆弱性が存在します。 CVE-2008-4106 34219 CVE-2008-4106 3964 5.1 http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-006221.html 2008-09-08 2012-12-20 View