CVE-2008-4106 in WordPress
Summary
WordPress before 2.6.2 does not properly handle MySQL warnings about insertion of username strings that exceed the maximum column width of the user_login column, and does not properly handle space characters when comparing usernames, which allows remote attackers to change an arbitrary user s password to a random value by registering a similar username and then requesting a password reset, related to a "SQL column truncation vulnerability." NOTE: the attacker can discover the random password by also exploiting CVE-2008-4107.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Reservation
09/15/2008
Disclosure
09/18/2008
Status
Confirmed
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 3825 | WordPress Password Generator input validation | 20 | Proof-of-Concept | Official fix | CVE-2008-4106 |