CVE-2012-10001 Auth bypass in n/a
The Limit Login Attempts plugin fails to clear authentication cookies during lockouts, potentially aiding brute-force attacks against user accounts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2012-10001?
CVE-2012-10001 is a critical authentication bypass vulnerability in n/a, published on 6 Jan 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Limit Login Attempts plugin before 1.7.1 for WordPress does not clear auth cookies upon a lockout, which might make it easier for remote attackers to conduct brute-force authentication attempts.
Weakness: CWE-287
Which versions are affected by CVE-2012-10001?
It affects 1 product.
Products include Limit Login Attempts Project Limit Login Attempts.
How do I fix CVE-2012-10001?
No fix has been published for CVE-2012-10001 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2012-10001 being exploited?
There is no known exploitation of CVE-2012-10001 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2022-0787 Limit Login Attempts (Spam Protection) < 5.1 - Unauthenticated SQLi
- CVE-2023-1912 Limit Login Attempts <= 1.7.1 - Unauthenticated Stored Cross-Site Scripting
- CVE-2021-24657 Limit Login Attempts < 4.0.50 - Unauthenticated Stored Cross-Site Scripting
- CVE-2023-1861 Limit Login Attempts < 1.7.2 - Subscriber+ Stored XSS
Sources
Also known as GHSA-5vrm-6rhq-6qv9.