CVE-2008-2146

wp-includes/vars.php in Wordpress before 2.2.3 does not properly extract the current path from the PATH_INFO ($PHP_SELF), which allows remote attackers to bypass intended access restrictions for certain pages.

Link	Resource
http://trac.wordpress.org/changeset/6029	Exploit
http://trac.wordpress.org/changeset?old_path=tags%2F2.2.2&old=6063&new_path=tags%2F2.2.3&new=6063#file10	Exploit
http://trac.wordpress.org/ticket/4748	Patch
http://osvdb.org/45188
https://exchange.xforce.ibmcloud.com/vulnerabilities/42379

Configuration 1

cpe:2.3:a:wordpress:wordpress:2.0.11:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:2.0:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:2.1.1:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:2.1.3_rc2:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:2.0.2:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:2.1:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:2.0.10_rc1:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:1.5-strayhorn:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:2.0.6:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:2.0.1:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:2.0.4:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:1.3.1:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:2.2_revision5003:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:0.711:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:0.6.2.1:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:1.4:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:2.2:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:1.2.1:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:0.7:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:2.1.3:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:2.0.7:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:2.2.0:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:2.1.2:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:0.71:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:2.0.5:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:0.6.2:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:1.5.1.1:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:2.0.9:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:2.2.1:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:1.5.2:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:1.6:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:1.0.1:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:2.0.10_rc2:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:1.0.2:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:2.0.3:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:1.5.1.2:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:1.2:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:2.1.3_rc1:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:1.2.2:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:2.0.10:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:1.0:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:1.5:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:1.5.1:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:1.5.1.3:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:2.2_revision5002:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:2.0.8:*:*:*:*:*:*:*

---

Published : 2008-05-12 08:20

Updated : 2017-08-08 01:30

---

NVD link : CVE-2008-2146

Mitre link : CVE-2008-2146

No products.

CWE-264