CVE-2009-3622

Algorithmic complexity vulnerability in wp-trackback.php in WordPress before 2.8.5 allows remote attackers to cause a denial of service (CPU consumption and server hang) via a long title parameter in conjunction with a charset parameter composed of many comma-separated "UTF-8" substrings, related to the mb_convert_encoding function in PHP.

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P

EPSS

5.83% chance of exploitation in the next 30 days, 93th percentile

Nuclei

medium

Published

2009-10-23

Updated

2024-08-07

Proof-of-concept exploits (1)

• http://rooibo.wordpress.com/2009/10/17/agujero-de-seguridad-en-wordpress/

Nuclei templates (1)

• topscoder/nuclei-wordfence-cve/blob/main/nuclei-templates/2009/CVE-2009-3622-wordpress-81…

References

• CVE Record
• NVD entry

Related

• CVE-2009-3621
• CVE-2009-3625
• CVE-2009-3613
• CVE-2009-3641
• CVE-2009-3601
• CVE-2009-3642