Access Restriction Bypass Affecting wordpress package, versions <2.2.3-1
Threat Intelligence
EPSS
0.9% (83rd
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-DEBIANUNSTABLE-WORDPRESS-362921
- published 12 May 2008
- disclosed 12 May 2008
Introduced: 12 May 2008
CVE-2008-2146 Open this link in a new tabHow to fix?
Upgrade Debian:unstable wordpress to version 2.2.3-1 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream wordpress package and not the wordpress package as distributed by Debian.
See How to fix? for Debian:unstable relevant fixed versions and status.
wp-includes/vars.php in Wordpress before 2.2.3 does not properly extract the current path from the PATH_INFO ($PHP_SELF), which allows remote attackers to bypass intended access restrictions for certain pages.
References
- https://security-tracker.debian.org/tracker/CVE-2008-2146
- http://osvdb.org/45188
- http://trac.wordpress.org/changeset/6029
- http://trac.wordpress.org/changeset?old_path=tags%2F2.2.2&old=6063&new_path=tags%2F2.2.3&new=6063#file10
- http://trac.wordpress.org/ticket/4748
- http://xforce.iss.net/xforce/xfdb/42379
- https://exchange.xforce.ibmcloud.com/vulnerabilities/42379
CVSS Scores
version 3.1