http://wordpress.org/development/2008/09/wordpress-262/

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Wordpress development team reports :

With open registration enabled, it is possible in WordPress versions 2.6.1 and earlier to craft a username such that it will allow resetting another users password to a randomly generated password. The randomly generated password is not disclosed to the attacker, so this problem by itself is annoying but not a security exploit. However, this attack coupled with a weakness in the random number seeding in mt_rand() could be used to predict the randomly generated password.

According to its banner, the version of PHP installed on the remote host is older than 5.2.5.  Such versions may be affected by various issues, including but not limited to several buffer overflows.

バナーによると、リモートホストにインストールされている PHP のバージョンは 5.2.5 より前です。このようなバージョンは、いくつかのバッファオーバーフローを含むがそれらに限定されない、さまざまな問題の影響を受けることがあります。

根据其标题，远程主机上安装的 PHP 版本早于 5.2.5。此类版本可能会受到各种问题的影响，包括但不限于多个缓冲区溢出。

根據其標題，遠端主機上安裝的 PHP 版本舊於 5.2.5。這些版本可能受到多個問題影響，包括但不限於一些緩衝區溢位。

The version of WordPress installed on the remote host is vulnerable to a flaw that would allow any user to reset the password of any other user account.  After resetting the password, the newly reset password would be sent to the email address linked to the account.   

ID	名稱	產品	系列	已發布	已更新	嚴重性
34173	Fedora 8 : wordpress-2.6.2-1.fc8 (2008-7760)	Nessus	Fedora Local Security Checks	2008/9/12	2021/1/11	medium
34152	FreeBSD : wordpress -- remote privilege escalation (884fced7-7f1c-11dd-a66a-0019666436c2)	Nessus	FreeBSD Local Security Checks	2008/9/10	2021/1/6	medium
28181	PHP < 5.2.5 Multiple Vulnerabilities	Nessus	CGI abuses	2007/11/12	2024/5/28	medium
34181	Fedora 9 : wordpress-2.6.2-1.fc9 (2008-7902)	Nessus	Fedora Local Security Checks	2008/9/12	2021/1/11	medium
28181	PHP < 5.2.5 の複数の脆弱性	Nessus	CGI abuses	2007/11/12	2024/5/28	medium
28181	PHP < 5.2.5 多种漏洞	Nessus	CGI abuses	2007/11/12	2024/5/28	medium
28181	PHP < 5.2.5 多種弱點	Nessus	CGI abuses	2007/11/12	2024/5/28	medium
4648	WordPress < 2.6.2 Administrative Password Reset	Nessus Network Monitor	CGI	2008/9/9	2019/3/6	medium

偵測

搜尋 Plugin

medium

medium

medium

medium

medium

medium

medium

medium