CVE-2014-0166: Medium severity WordPress vulnerability
The wpvalidateauthcookie function in wp-includes/pluggable.php in WordPress before 3.7.2 and 3.8.x before 3.8.2 does not properly determine the validity of authentication cookies, which makes it easier for remote attackers to obtain access via a forged cookie.
Other sources
WordPress 3.8.2 has been released and fixes an that could allow authentication to be bypassed:
"This releases fixes a weakness that could let an attacker force their way into your site by forging authentication cookies."
"Potential authentication cookie forgery. CVE-2014-0166."
References:
http://wordpress.org/news/2014/04/wordpress-3-8-2/ http://codex.wordpress.org/Version3.8.2
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/wordpressto a version that resolves this vulnerability.Fixed in 3.8.2 - Upgrade
Upgrade
wordpressto a version that resolves this vulnerability.Fixed in 3.8.2Patch CVE-2014-0166
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0166?
CVE-2014-0166 is considered to be a high severity vulnerability due to its potential to allow remote attackers to gain unauthorized access via forged cookies.
How do I fix CVE-2014-0166?
To fix CVE-2014-0166, you should upgrade your WordPress installation to version 3.8.2 or later.
What versions of WordPress are affected by CVE-2014-0166?
CVE-2014-0166 affects all versions of WordPress prior to 3.8.2, including versions 3.7.x and earlier.
Is there a workaround for CVE-2014-0166?
There is no known workaround for CVE-2014-0166; the best mitigation is to update to the latest version of WordPress.
What component of WordPress does CVE-2014-0166 impact?
CVE-2014-0166 impacts the wp_validate_auth_cookie function in the pluggable.php file of WordPress.