Vulnerabilities > CVE-2014-9039 - 7PK - Security Features vulnerability in multiple products

047910
CVSS 4.3 - MEDIUM
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
NONE
Availability impact
NONE

Summary

wp-login.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to reset passwords by leveraging access to an e-mail account that received a password-reset message.

Vulnerable Configurations

Part Description Count
OS
Debian
2
OS
Mageia_Project
2
Application
Wordpress
285

Common Weakness Enumeration (CWE)

Nessus

  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-236.NASL
    descriptionIn the Debian squeeze-lts version of Wordpress, multiple security issues have been fixed : Remote attackers could... - ... upload files with invalid or unsafe names - ... mount social engineering attacks - ... compromise a site via cross-site scripting - ... inject SQL commands - ... cause denial of service or information disclosure CVE-2014-9031 Jouko Pynnonen discovered an unauthenticated cross site scripting vulnerability (XSS) in wptexturize(), exploitable via comments or posts. CVE-2014-9033 Cross site request forgery (CSRF) vulnerability in the password changing process, which could be used by an attacker to trick an user into changing her password. CVE-2014-9034 Javier Nieto Arevalo and Andres Rojas Guerrero reported a potential denial of service in the way the phpass library is used to handle passwords, since no maximum password length was set. CVE-2014-9035 John Blackbourn reported an XSS in the
    last seen2020-03-17
    modified2015-06-02
    plugin id83918
    published2015-06-02
    reporterThis script is Copyright (C) 2015-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/83918
    titleDebian DLA-236-1 : wordpress security update
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Debian Security Advisory DLA-236-1. The text
    # itself is copyright (C) Software in the Public Interest, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(83918);
      script_version("2.6");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/12");
    
      script_cve_id("CVE-2014-9031", "CVE-2014-9033", "CVE-2014-9034", "CVE-2014-9035", "CVE-2014-9036", "CVE-2014-9037", "CVE-2014-9038", "CVE-2014-9039", "CVE-2015-3438", "CVE-2015-3439", "CVE-2015-3440");
      script_bugtraq_id(71231, 71232, 71233, 71234, 71236, 71237, 71238, 74269, 74334);
    
      script_name(english:"Debian DLA-236-1 : wordpress security update");
      script_summary(english:"Checks dpkg output for the updated packages.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Debian host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "In the Debian squeeze-lts version of Wordpress, multiple security
    issues have been fixed :
    
    Remote attackers could...
    
      - ... upload files with invalid or unsafe names
    
      - ... mount social engineering attacks
    
      - ... compromise a site via cross-site scripting
    
      - ... inject SQL commands
    
      - ... cause denial of service or information disclosure
    
    CVE-2014-9031
    
    Jouko Pynnonen discovered an unauthenticated cross site scripting
    vulnerability (XSS) in wptexturize(), exploitable via comments or
    posts.
    
    CVE-2014-9033
    
    Cross site request forgery (CSRF) vulnerability in the password
    changing process, which could be used by an attacker to trick an user
    into changing her password.
    
    CVE-2014-9034
    
    Javier Nieto Arevalo and Andres Rojas Guerrero reported a potential
    denial of service in the way the phpass library is used to handle
    passwords, since no maximum password length was set.
    
    CVE-2014-9035
    
    John Blackbourn reported an XSS in the 'Press This' function (used for
    quick publishing using a browser 'bookmarklet').
    
    CVE-2014-9036
    
    Robert Chapin reported an XSS in the HTML filtering of CSS in posts.
    
    CVE-2014-9037
    
    David Anderson reported a hash comparison vulnerability for passwords
    stored using the old-style MD5 scheme. While unlikely, this could be
    exploited to compromise an account, if the user had not logged in
    after a Wordpress 2.5 update (uploaded to Debian on 2 Apr, 2008) and
    the password MD5 hash could be collided with due to PHP dynamic
    comparison.
    
    CVE-2014-9038
    
    Ben Bidner reported a server side request forgery (SSRF) in the core
    HTTP layer which unsufficiently blocked the loopback IP address space.
    
    CVE-2014-9039
    
    Momen Bassel, Tanoy Bose, and Bojan Slavkovic reported a vulnerability
    in the password reset process: an email address change would not
    invalidate a previous password reset email.
    
    CVE-2015-3438
    
    Cedric Van Bockhaven reported and Gary Pendergast, Mike Adams, and
    Andrew Nacin of the WordPress security team fixed a
    cross-site-scripting vulnerabilitity, which could enable anonymous
    users to compromise a site. 
    
    CVE-2015-3439
    
    Jakub Zoczek discovered a very limited cross-site scripting
    vulnerability, that could be used as part of a social engineering
    attack.
    
    CVE-2015-3440
    
    Jouko Pynnönen discovered a cross-site scripting vulnerability,
    which could enable commenters to compromise a site.
    
    NOTE: Tenable Network Security has extracted the preceding description
    block directly from the DLA security advisory. Tenable has attempted
    to automatically clean and format it as much as possible without
    introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://lists.debian.org/debian-lts-announce/2015/06/msg00000.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://packages.debian.org/source/squeeze-lts/wordpress"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Upgrade the affected wordpress, and wordpress-l10n packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:wordpress");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:wordpress-l10n");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:6.0");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2015/06/01");
      script_set_attribute(attribute:"plugin_publication_date", value:"2015/06/02");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2015-2020 Tenable Network Security, Inc.");
      script_family(english:"Debian Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("debian_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
    if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (deb_check(release:"6.0", prefix:"wordpress", reference:"3.6.1+dfsg-1~deb6u6")) flag++;
    if (deb_check(release:"6.0", prefix:"wordpress-l10n", reference:"3.6.1+dfsg-1~deb6u6")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());
      else security_warning(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-3085.NASL
    descriptionMultiple security issues have been discovered in Wordpress, a web blogging tool, resulting in denial of service or information disclosure. More information can be found in the upstream advisory at - CVE-2014-9031 Jouko Pynnonen discovered an unauthenticated cross site scripting vulnerability (XSS) in wptexturize(), exploitable via comments or posts. - CVE-2014-9033 Cross site request forgery (CSRF) vulnerability in the password changing process, which could be used by an attacker to trick an user into changing her password. - CVE-2014-9034 Javier Nieto Arevalo and Andres Rojas Guerrero reported a potential denial of service in the way the phpass library is used to handle passwords, since no maximum password length was set. - CVE-2014-9035 John Blackbourn reported an XSS in the
    last seen2020-03-17
    modified2014-12-04
    plugin id79696
    published2014-12-04
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/79696
    titleDebian DSA-3085-1 : wordpress - security update
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_5E1351788AEB11E4801F0022156E8794.NASL
    descriptionMITRE reports : wp-login.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to reset passwords by leveraging access to an e-mail account that received a password-reset message. wp-includes/http.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to conduct server-side request forgery (SSRF) attacks by referring to a 127.0.0.0/8 resource. WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to obtain access to an account idle since 2008 by leveraging an improper PHP dynamic type comparison for an MD5 hash. Cross-site scripting (XSS) vulnerability in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via a crafted Cascading Style Sheets (CSS) token sequence in a post. Cross-site scripting (XSS) vulnerability in Press This in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors wp-includes/class-phpass.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to cause a denial of service (CPU consumption) via a long password that is improperly handled during hashing, a similar issue to CVE-2014-9016. Cross-site request forgery (CSRF) vulnerability in wp-login.php in WordPress 3.7.4, 3.8.4, 3.9.2, and 4.0 allows remote attackers to hijack the authentication of arbitrary users for requests that reset passwords.
    last seen2020-06-01
    modified2020-06-02
    plugin id80350
    published2015-01-05
    reporterThis script is Copyright (C) 2015-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/80350
    titleFreeBSD : wordpress -- multiple vulnerabilities (5e135178-8aeb-11e4-801f-0022156e8794)
  • NASL familyMandriva Local Security Checks
    NASL idMANDRIVA_MDVSA-2014-233.NASL
    descriptionUpdated wordpress package fixes security vulnerabilities : XSS in wptexturize() via comments or posts, exploitable for unauthenticated users (CVE-2014-9031). XSS in media playlists (CVE-2014-9032). CSRF in the password reset process (CVE-2014-9033). Denial of service for giant passwords. The phpass library by Solar Designer was used in both projects without setting a maximum password length, which can lead to CPU exhaustion upon hashing (CVE-2014-9034). XSS in Press This (CVE-2014-9035). XSS in HTML filtering of CSS in posts (CVE-2014-9036). Hash comparison vulnerability in old-style MD5-stored passwords (CVE-2014-9037). SSRF: Safe HTTP requests did not sufficiently block the loopback IP address space (CVE-2014-9038). Previously an email address change would not invalidate a previous password reset email (CVE-2014-9039).
    last seen2020-06-01
    modified2020-06-02
    plugin id79613
    published2014-11-28
    reporterThis script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/79613
    titleMandriva Linux Security Advisory : wordpress (MDVSA-2014:233)
  • NASL familyCGI abuses
    NASL idWORDPRESS_4_0_1.NASL
    descriptionAccording to its version number, the WordPress application installed on the remote web server is affected by multiple vulnerabilities : - Multiple unspecified errors exist that could allow cross-site scripting attacks. - An unspecified error exists that could allow cross-site request forgery attacks. - An error exists related to password handling that could allow denial of service attacks. - An unspecified error exists that could allow server-side request forgery attacks. - A hash collision error exists that could allow a user account to be compromised. - An error exists related to password reset processing that could allow a user account to be compromised. - An error exists related to the post or page comment field that could allow persistent cross-site scripting attacks. Note that Nessus has not tested for these issues but has instead relied only on the application
    last seen2020-06-01
    modified2020-06-02
    plugin id79437
    published2014-11-25
    reporterThis script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/79437
    titleWordPress < 3.7.5 / 3.8.5 / 3.9.3 / 4.0.1 Multiple Vulnerabilities
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2014-15560.NASL
    descriptionWordPress 4.0.1 Security Release See: https://wordpress.org/news/2014/11/wordpress-4-0-1/ Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-03-17
    modified2014-12-07
    plugin id79774
    published2014-12-07
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/79774
    titleFedora 21 : wordpress-4.0.1-1.fc21 (2014-15560)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2014-15526.NASL
    descriptionWordPress 4.0.1 Security Release See: https://wordpress.org/news/2014/11/wordpress-4-0-1/ Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-03-17
    modified2014-12-03
    plugin id79678
    published2014-12-03
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/79678
    titleFedora 19 : wordpress-4.0.1-1.fc19 (2014-15526)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2014-15507.NASL
    descriptionWordPress 4.0.1 Security Release See: https://wordpress.org/news/2014/11/wordpress-4-0-1/ Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-03-17
    modified2014-12-03
    plugin id79674
    published2014-12-03
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/79674
    titleFedora 20 : wordpress-4.0.1-1.fc20 (2014-15507)