high7.5
CVE-2008-2146
wp-includes/vars.php in Wordpress before 2.2.3 does not properly extract the current path from the PATH_INFO ($PHP_SELF), which allows remote attackers to bypa…
Impact
wp-includes/vars.php in Wordpress before 2.2.3 does not properly extract the current path from the PATH_INFO ($PHP_SELF), which allows remote attackers to bypass intended access restrictions for certain pages.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Wordpress | Wordpress | through 2.2.2 Versions 0.6.2, 0.6.2.1, 0.7, 0.71, 0.711 |
Weakness classification
References
- NVD record
- CVE.org record
- http://osvdb.org/45188
- http://trac.wordpress.org/changeset/6029
- http://trac.wordpress.org/changeset?old_path=tags%2F2.2.2&old=6063&new_path=tags%2F2.2.3&new=6063#file10
- http://trac.wordpress.org/ticket/4748
- https://exchange.xforce.ibmcloud.com/vulnerabilities/42379
- http://osvdb.org/45188
- http://trac.wordpress.org/changeset/6029
- http://trac.wordpress.org/changeset?old_path=tags%2F2.2.2&old=6063&new_path=tags%2F2.2.3&new=6063#file10
- http://trac.wordpress.org/ticket/4748
- https://exchange.xforce.ibmcloud.com/vulnerabilities/42379