WordPress Vulnerabilities

WordPress 3.4.2 - 3.9.2 Does Not Invalidate Sessions Upon Logout

Affects WordPress

3.4.2
Fixed in WordPress 4.0
3.5
Fixed in WordPress 4.0
3.5.1
Fixed in WordPress 4.0
3.5.2
Fixed in WordPress 4.0
3.6
Fixed in WordPress 4.0
3.6.1
Fixed in WordPress 4.0
3.7
Fixed in WordPress 4.0
3.7.1
Fixed in WordPress 4.0
3.8
Fixed in WordPress 4.0
3.8.1
Fixed in WordPress 4.0
3.8.2
Fixed in WordPress 4.0
3.8.3
Fixed in WordPress 4.0
3.9
Fixed in WordPress 4.0
3.9.1
Fixed in WordPress 4.0
3.9.2
Fixed in WordPress 4.0

References

CVE
CVE-2012-5868
URL
http://whiteoaksecurity.com/blog/2012/12/17/cve-2012-5868-wordpress-342-sessions-not-terminated-upon-explicit-user-logout
URL
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/leveraging-lfi-to-get-full-compromise-on-wordpress-sites/

Classification

Type
AUTHBYPASS
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-287

Miscellaneous

Submitter
admin
Verified
No
WPVDB ID
8ee5c93f-6dd4-4001-b805-0d62a2475932

Timeline

Publicly Published
2014-09-17 (about 9 years ago)
Added
2014-09-17 (about 9 years ago)
Last Updated
2019-10-21 (about 4 years ago)

Other

Published
Title
Published
2016-09-19
Title
Order Export Import for WooCommerce 1.0.8 - Order Information Disclosure
Published
2015-01-17
Title
Pie Register <= 2.0.13 - Privilege escalation
Published
2021-12-14
Title
All In One SEO < 4.1.5.3 - Authenticated Privilege Escalation
Published
2014-08-01
Title
Contact Form 7 <= 3.7.1 - CAPTCHA Bypass
Published
2021-10-11
Title
Pie Register < 3.1.7.6 - Unauthenticated Arbitrary Login