Vulnerability in N/a
CVE-2009-2335
WordPress and WordPress MU before 2.8.1 exhibit different behavior for a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. NOTE: the vendor reportedly disputes t…
EPSS: 0.853 (99.4th percentile) — read the EPSS interpretation.
Affected products
- N/a — versions n/a
Public proof-of-concept exploits
References
- FEDORA-2009-8538 (x_refsource_FEDORA, vendor-advisory)
- corelabs.coresecurity.com/index.php (x_refsource_MISC)
- FEDORA-2009-7729 (x_refsource_FEDORA, vendor-advisory)
- 20090708 CORE-2009-01515 - WordPress Privileges Unchecked in admin.php and Multiple Information (mailing-list, x_refsource_BUGTRAQ)
- 1022528 (vdb-entry, x_refsource_SECTRACK)
- FEDORA-2009-7701 (x_refsource_FEDORA, vendor-advisory)
- ADV-2009-1833 (vdb-entry, x_refsource_VUPEN)
- FEDORA-2009-8529 (x_refsource_FEDORA, vendor-advisory)
- 55713 (x_refsource_OSVDB, vdb-entry)
- 9110 (exploit, x_refsource_EXPLOIT-DB)
Frequently asked questions
- What is CVE-2009-2335?
- CVE-2009-2335 is a vulnerability in N/a. Published 2009-07-10.
- Is CVE-2009-2335 known to be exploited?
- 8 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.