CVE-2014-9037: debian debian_linux Cryptographic Issues
CVSS: 8.1v3.1HighModified
AliasesDEBIAN-CVE-2014-9037
Published 25-11-2014Last modified 06-08-2024
Vulnerability summary
CVE-2014-9037 is a high (CVSS 8.1) Cryptographic Issues vulnerability in debian debian_linux. EPSS estimates a 2.57% chance of exploitation in the next 30 days, higher than 84.9% of scored vulnerabilities.
CVSS score
8.1/10
010
High · v3.1 (wordfence)EPSS score
2.57%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 3Timeline
- 25-11-2014PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to obtain access to an account idle since 2008 by leveraging an improper PHP dynamic type comparison for an MD5 hash.
CVSS metrics
2 scores · 2 sources · 2 versionsHigh 8.1Preferred score · wordfence (Source)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesSingle source
Medium 6.8Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
2.57%
Chance of exploitation in the next 30 days
Percentile
85%
Versus all other CVEs
30-day change
0.00 pp
From 2.57% on 19-09-2026
19-09-202619-10-2026
EPSS score2.57%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-310Cryptographic IssuesWeaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.
- CWE-916Use of Password Hash With Insufficient Computational EffortThe product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.
Affected systems
Debian2 products
- wordpress< 4.0.1+dfsg-1
- debian_linuxEOL7.0 | 8.0
Wordpress2 products
- wordpress< 3.7 (fixed in 3.7.5) | ≥ 3.7, ≤ 3.7.4 (fixed in 3.7.5) | ≥ 3.8, ≤ 3.8.4 (fixed in 3.7.5) | ≥ 3.9, ≤ 3.9.2 (fixed in 3.7.5) | 4.0 (fixed in 3.7.5)
- wordpressEOL≤ 3.7.4 | 3.8 | 3.8.1 | 3.8.2 | 3.8.3 | 3.8.4 | 3.9 | 3.9.1 | 3.9.2 | 4.0
Mageia_project1 product
- mageia3 | 4
3 vendors · 5 products
References
8 links
- advisories.mageia.org/MGASA-2014-0493.htmlX Refsource CONFIRM