CVE-2014-9034
NoneCVSS
—
EPSS
82.7%
Published
Nov 25, 2014
CISA due date
—
The record
wp-includes/class-phpass.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to cause a denial of service (CPU consumption) via a long password that is improperly handled during hashing, a similar issue to CVE-2014-9016.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | wordpress | 0 | 4.0.1+dfsg-1 |
| Debian:12 | wordpress | 0 | 4.0.1+dfsg-1 |
| Debian:13 | wordpress | 0 | 4.0.1+dfsg-1 |
| Debian:6.0 | wordpress | 0 | 3.6.1+dfsg-1~deb6u6 |
| Debian:7 | wordpress | 0 | 3.6.1+dfsg-1~deb7u5 |
| Mageia:3 | wordpress | 0 | 3.9.3-1.mga3 |
| Mageia:4 | wordpress | 0 | 3.9.3-1.mga4 |
Related vulnerabilities
- CVE-2022-4973 WordPress Core, in versions up to 6.0.2, is vulnerable to Authenticated Stored Cross-Site… Also affects wordpress
- CVE-2024-31111 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site… Also affects wordpress
- CVE-2024-6307 WordPress Core is vulnerable to Stored Cross-Site Scripting via the HTML API in various… Also affects wordpress
- CVE-2024-4439 WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the… Also affects wordpress
- CVE-2023-5692 WordPress Core is vulnerable to Sensitive Information Exposure in versions up to, and… Also affects wordpress
- CVE-2024-31210 WordPress is an open publishing platform for the Web. Also affects wordpress
- CVE-2023-2745 WordPress Core is vulnerable to Directory Traversal in versions up to, and including… Also affects wordpress
- CVE-2017-14719 Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during… Also affects wordpress