CVE-2009-2335

Description

WordPress and WordPress MU before 2.8.1 exhibit different behavior for a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. NOTE: the vendor reportedly disputes the significance of this issue, indicating that the behavior exists for "user convenience."

How to fix CVE-2009-2335

To remediate CVE-2009-2335, upgrade the affected package to a fixed version below.

• Debian/wordpress—upgrade to 2.8.3-1 or later

Is CVE-2009-2335 being exploited?

Likely — EPSS is 85.3%, placing CVE-2009-2335 in the top tier of vulnerabilities by exploitation probability. Prioritise patching.

Affected packages (1)

• from 0, < 2.8.3-1

References (1)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2009-2335