CVE-2011-4898

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error messages for requests lacking a dbname parameter depending on whether the MySQL credentials are valid, which makes it easier for remote attackers to conduct brute-force attacks via a series of requests with different uname and pwd parameters. NOTE: the vendor disputes the significance of this issue; also, it is unclear whether providing intentionally vague error messages during installation would be reasonable from a usability perspective

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:N/I:N/A:P

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Jan 30, 2012
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2011

CVE-2011-48997.5wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specified MySQL database ser CVE-2011-49006.5TYPO3 before 4.5.4 allows Information Disclosure in the backend.CVE-2011-49016.5TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to extract arbitrary information from the TYPO3 data CVE-2011-49026.5TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to delete arbitrary files on the webserver.CVE-2011-49036.1Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary we CVE-2011-49046.5TYPO3 before 4.4.9 and 4.5.x before 4.5.4 does not apply proper access control on ExtDirect calls which allows remote attackers to retrieve CVE-2011-49055.0Apache ActiveMQ before 5.6.0 allows remote attackers to cause a denial of service (file-descriptor exhaustion and broker crash or hang) by s CVE-2011-49069.8Tiny browser in TinyMCE 3.0 editor in Joomla! before 1.5.13 allows file upload and arbitrary PHP code execution.CVE-2011-49075.3Joomla! 1.5x through 1.5.12: Missing JEXEC Check CVE-2011-49089.8TinyBrowser plugin for Joomla! before 1.5.13 allows arbitrary file upload via upload.php.CVE-2011-49094.3Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1.5.12 allow remote attackers to inject arbitrary web script or HTML v CVE-2011-49104.3Cross-site scripting (XSS) vulnerability in Joomla! before 1.5.12 allows remote attackers to inject arbitrary web script or HTML via the PAT