CVE-2011-4898 Information disclosure in n/a
Remote attackers can brute-force MySQL credentials during WordPress installation due to distinct error messages revealing credential validity.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2011-4898?
CVE-2011-4898 is a medium-severity vulnerability in Wordpress Wordpress, published on 30 Jan 2012. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error messages for requests lacking a dbname parameter depending on whether the MySQL credentials are valid, which makes it easier for remote attackers to conduct brute-force attacks via a series of requests with different uname and pwd parameters. NOTE: the vendor disputes the significance of this issue; also, it is unclear whether providing intentionally vague error messages during installation would be reasonable from a usability perspective
Weakness: CWE-200
Which versions are affected by CVE-2011-4898?
It affects 1 product.
Products include Wordpress Wordpress.
How do I fix CVE-2011-4898?
No fix has been published for CVE-2011-4898 yet. Limit exposure of the affected software until one is available.
Is CVE-2011-4898 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2011-4898 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Wordpress Wordpress
Sources
Also known as DEBIAN-CVE-2011-4898, GHSA-q2qm-9w2w-5x96.