CVE-2007-0109 - Vulnerability Details - OpenCVE

wp-login.php in WordPress 2.0.5 and earlier displays different error messages if a user exists or not, which allows remote attackers to obtain sensitive information and facilitates brute force attacks.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.01335.

Key SSVC decision points have not yet been added.

Vendors	Products
Wordpress	Wordpress

Configuration 1 [-]

OR	cpe:2.3:a:wordpress:wordpress:2.0:::::::*
	cpe:2.3:a:wordpress:wordpress:2.0.1:::::::*
	cpe:2.3:a:wordpress:wordpress:2.0.2:::::::*
	cpe:2.3:a:wordpress:wordpress:2.0.3:::::::*
	cpe:2.3:a:wordpress:wordpress:2.0.4:::::::*
	cpe:2.3:a:wordpress:wordpress:2.0.5:::::::*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2007-0113	wp-login.php in WordPress 2.0.5 and earlier displays different error messages if a user exists or not, which allows remote attackers to obtain sensitive information and facilitates brute force attacks.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://osvdb.org/31577
http://secunia.com/advisories/23621
http://secunia.com/advisories/23741
http://security.gentoo.org/glsa/glsa-200701-10.xml
http://securityreason.com/securityalert/2113
http://www.securityfocus.com/archive/1/455927/100/0/threaded
http://www.vupen.com/english/advisories/2007/0062
https://exchange.xforce.ibmcloud.com/vulnerabilities/31262

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2007-01-09T00:00:00

Updated: 2024-08-07T12:03:37.159Z

Reserved: 2007-01-08T00:00:00

Link: CVE-2007-0109

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2007-01-09T00:28:00.000

Modified: 2025-04-09T00:30:58.490

Link: CVE-2007-0109

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2007-01-03T00:00:00", "descriptions": [{"lang": "en", "value": "wp-login.php in WordPress 2.0.5 and earlier displays different error messages if a user exists or not, which allows remote attackers to obtain sensitive information and facilitates brute force attacks."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-16T14:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "31577", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/31577"}, {"name": "23621", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/23621"}, {"name": "wordpress-account-enumeration(31262)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31262"}, {"name": "23741", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/23741"}, {"name": "GLSA-200701-10", "tags": ["vendor-advisory", "x_refsource_GENTOO"], "url": "http://security.gentoo.org/glsa/glsa-200701-10.xml"}, {"name": "ADV-2007-0062", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2007/0062"}, {"name": "20070103 Wordpress <= 2.x dictionnary & Bruteforce attack", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/455927/100/0/threaded"}, {"name": "2113", "tags": ["third-party-advisory", "x_refsource_SREASON"], "url": "http://securityreason.com/securityalert/2113"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2007-0109", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "wp-login.php in WordPress 2.0.5 and earlier displays different error messages if a user exists or not, which allows remote attackers to obtain sensitive information and facilitates brute force attacks."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "31577", "refsource": "OSVDB", "url": "http://osvdb.org/31577"}, {"name": "23621", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/23621"}, {"name": "wordpress-account-enumeration(31262)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31262"}, {"name": "23741", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/23741"}, {"name": "GLSA-200701-10", "refsource": "GENTOO", "url": "http://security.gentoo.org/glsa/glsa-200701-10.xml"}, {"name": "ADV-2007-0062", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2007/0062"}, {"name": "20070103 Wordpress <= 2.x dictionnary & Bruteforce attack", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/455927/100/0/threaded"}, {"name": "2113", "refsource": "SREASON", "url": "http://securityreason.com/securityalert/2113"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T12:03:37.159Z"}, "title": "CVE Program Container", "references": [{"name": "31577", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/31577"}, {"name": "23621", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/23621"}, {"name": "wordpress-account-enumeration(31262)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31262"}, {"name": "23741", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/23741"}, {"name": "GLSA-200701-10", "tags": ["vendor-advisory", "x_refsource_GENTOO", "x_transferred"], "url": "http://security.gentoo.org/glsa/glsa-200701-10.xml"}, {"name": "ADV-2007-0062", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2007/0062"}, {"name": "20070103 Wordpress <= 2.x dictionnary & Bruteforce attack", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/455927/100/0/threaded"}, {"name": "2113", "tags": ["third-party-advisory", "x_refsource_SREASON", "x_transferred"], "url": "http://securityreason.com/securityalert/2113"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2007-0109", "datePublished": "2007-01-09T00:00:00", "dateReserved": "2007-01-08T00:00:00", "dateUpdated": "2024-08-07T12:03:37.159Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wordpress:wordpress:2.0:*:*:*:*:*:*:*", "matchCriteriaId": "BDCFE9AA-39E9-4366-AAB7-F7A891BC797E", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:2.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "BAF4671A-8449-438E-922B-94E5542137BC", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:2.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "92F05A1F-2227-4166-807B-1BDE2EA8F245", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:2.0.3:*:*:*:*:*:*:*", "matchCriteriaId": "0CF73E23-7CD0-429C-986B-5F721F1696BC", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:2.0.4:*:*:*:*:*:*:*", "matchCriteriaId": "EECE66B3-3696-4E98-AF63-DF2FB256A6FB", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:2.0.5:*:*:*:*:*:*:*", "matchCriteriaId": "E75BB382-6B47-4C6A-BF94-80443BEB1A23", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "wp-login.php in WordPress 2.0.5 and earlier displays different error messages if a user exists or not, which allows remote attackers to obtain sensitive information and facilitates brute force attacks."}, {"lang": "es", "value": "wp-login.php en WordPress 2.0.5 y anteriores muestra diferentes mensajes de error si un usuario existe o no, lo cual permite a atacantes remotos obtener informaci\u00f3n sensible y facilita ataques de fuerza bruta."}], "id": "CVE-2007-0109", "lastModified": "2025-04-09T00:30:58.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2007-01-09T00:28:00.000", "references": [{"source": "cve@mitre.org", "url": "http://osvdb.org/31577"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/23621"}, {"source": "cve@mitre.org", "url": "http://secunia.com/advisories/23741"}, {"source": "cve@mitre.org", "url": "http://security.gentoo.org/glsa/glsa-200701-10.xml"}, {"source": "cve@mitre.org", "url": "http://securityreason.com/securityalert/2113"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/455927/100/0/threaded"}, {"source": "cve@mitre.org", "url": "http://www.vupen.com/english/advisories/2007/0062"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31262"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://osvdb.org/31577"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/23621"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/23741"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://security.gentoo.org/glsa/glsa-200701-10.xml"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://securityreason.com/securityalert/2113"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/455927/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.vupen.com/english/advisories/2007/0062"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31262"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}