CVE-2012-5868 Information disclosure in n/a
Failure to invalidate session cookies on logout allows attackers to brute-force valid admin session IDs, leading to data disclosure and modification.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2012-5868?
CVE-2012-5868 is a low-severity vulnerability in Wordpress Wordpress, published on 27 Dec 2012. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
WordPress 3.4.2 does not invalidate a wordpress_sec session cookie upon an administrator's logout action, which makes it easier for remote attackers to discover valid session identifiers via a brute-force attack, or modify data via a replay attack.
Weakness: CWE-200
Which versions are affected by CVE-2012-5868?
It affects 1 product.
Products include Wordpress Wordpress.
How do I fix CVE-2012-5868?
No fix has been published for CVE-2012-5868 yet. Limit exposure of the affected software until one is available.
Is CVE-2012-5868 being exploited?
There is no known exploitation of CVE-2012-5868 in the wild and no public exploit code.
Other vulnerabilities in Wordpress Wordpress
Sources
Also known as DEBIAN-CVE-2012-5868, GHSA-vpmj-9973-3qg4, UBUNTU-CVE-2012-5868.