CVE-2012-0937 Server-side request forgery in n/a
Remote attackers can exploit the WordPress installation script to proxy brute-force or denial-of-service attacks against external MySQL servers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2012-0937?
CVE-2012-0937 is a medium-severity server-side request forgery vulnerability in Wordpress Wordpress, published on 30 Jan 2012. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not limit the number of MySQL queries sent to external MySQL database servers, which allows remote attackers to use WordPress as a proxy for brute-force attacks or denial of service attacks via the dbhost parameter, a different vulnerability than CVE-2011-4898. NOTE: the vendor disputes the significance of this issue because an incomplete WordPress installation might be present on the network for only a short time
Which versions are affected by CVE-2012-0937?
It affects 1 product.
Products include Wordpress Wordpress.
How do I fix CVE-2012-0937?
No fix has been published for CVE-2012-0937 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2012-0937 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2012-0937 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Wordpress Wordpress
Sources
Also known as DEBIAN-CVE-2012-0937, GHSA-rrrf-759h-mc79.