oss-security - Re: CVE id request: wordpress

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / NEWS community lists Wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [month] [year] [list]

Date: Mon, 12 May 2008 15:37:31 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
Subject: Re: CVE id request: wordpress

======================================================
Name: CVE-2008-2146
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2146
Reference: CONFIRM:http://trac.wordpress.org/changeset/6029
Reference: CONFIRM:http://trac.wordpress.org/changeset?old_path=tags%2F2.2.2&old=6063&new_path=tags%2F2.2.3&new=6063#file10
Reference: CONFIRM:http://trac.wordpress.org/ticket/4748

wp-includes/vars.php in Wordpress before 2.2.3 does not properly
extract the current pafe from the PATH_INFO ($PHP_SELF), which allows
remote attackers to bypass intended access restrictions for certain
pages.

1

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.