CVE-2012-5868
WordPress Core < 4.0 - Missing Session Cookie Expiration
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
WordPress 3.4.2 does not invalidate a wordpress_sec session cookie upon an administrator's logout action, which makes it easier for remote attackers to discover valid session identifiers via a brute-force attack, or modify data via a replay attack.
WordPress v3.4.2 no invalida una cookie de sesión wordpress_sec cookie en una acción de desconexió del administrador, lo que hace que sea más fácil para los atacantes remotos a la hora de descubrir identificadores de sesión válidos a través de un ataque de fuerza bruta, o modificar datos a través de un ataque de reproducción.
WordPress Core before 4.0 does not invalidate a wordpress_sec session cookie upon an administrator's logout action, which makes it easier for remote attackers to discover valid session identifiers via a brute-force attack, or modify data via a replay attack.
WordPress version 3.4.2 fails to invalidate a user's session upon logout. Although it clears the cookie in the browser, the system will still accept it.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2012-11-14 CVE Reserved
- 2012-12-20 CVE Published
- 2024-09-16 CVE Updated
- 2025-08-04 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
- CWE-613: Insufficient Session Expiration
CAPEC
References (1)
| URL | Tag | Source |
|---|---|---|
| http://whiteoaksecurity.com/blog/2012/12/17/cve-2012-5868-wordpress-342-sessions-not-terminated-upon-explicit-user-logout | X_refsource_misc |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|