Lucene search

[email protected]CVE-2008-2146

HistoryMay 12, 2008 - 8:20 p.m.

CVE-2008-2146

2008-05-1220:20:00

CWE-264

[email protected]

web.nvd.nist.gov

cve

2008

2146

wordpress

vulnerability

path extraction

access restriction

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

6.5 Medium

AI Score

Confidence

Low

0.009 Low

EPSS

Percentile

82.8%

JSON

wp-includes/vars.php in Wordpress before 2.2.3 does not properly extract the current path from the PATH_INFO ($PHP_SELF), which allows remote attackers to bypass intended access restrictions for certain pages.

Affected configurations

NVD

Node

wordpresswordpressRange≤2.2.2

wordpresswordpressMatch0.6.2

wordpresswordpressMatch0.6.2.1

wordpresswordpressMatch0.7

wordpresswordpressMatch0.71

wordpresswordpressMatch0.711

wordpresswordpressMatch1.0

wordpresswordpressMatch1.0.1

wordpresswordpressMatch1.0.2

wordpresswordpressMatch1.2

wordpresswordpressMatch1.2.1

wordpresswordpressMatch1.2.2

wordpresswordpressMatch1.3.1

wordpresswordpressMatch1.4

wordpresswordpressMatch1.5

wordpresswordpressMatch1.5-strayhorn

wordpresswordpressMatch1.5.1

wordpresswordpressMatch1.5.1.1

wordpresswordpressMatch1.5.1.2

wordpresswordpressMatch1.5.1.3

wordpresswordpressMatch1.5.2

wordpresswordpressMatch1.6

wordpresswordpressMatch2.0

wordpresswordpressMatch2.0.1

wordpresswordpressMatch2.0.2

wordpresswordpressMatch2.0.3

wordpresswordpressMatch2.0.4

wordpresswordpressMatch2.0.5

wordpresswordpressMatch2.0.6

wordpresswordpressMatch2.0.7

wordpresswordpressMatch2.0.8

wordpresswordpressMatch2.0.9

wordpresswordpressMatch2.0.10

wordpresswordpressMatch2.0.10_rc1

wordpresswordpressMatch2.0.10_rc2

wordpresswordpressMatch2.0.11

wordpresswordpressMatch2.1

wordpresswordpressMatch2.1.1

wordpresswordpressMatch2.1.2

wordpresswordpressMatch2.1.3

wordpresswordpressMatch2.1.3_rc1

wordpresswordpressMatch2.1.3_rc2

wordpresswordpressMatch2.2

wordpresswordpressMatch2.2.0

wordpresswordpressMatch2.2.1

wordpresswordpressMatch2.2_revision5002

wordpresswordpressMatch2.2_revision5003

CPENameOperatorVersion
wordpress:wordpresswordpressle2.2.2
wordpress:wordpresswordpresseq0.6.2
wordpress:wordpresswordpresseq0.6.2.1
wordpress:wordpresswordpresseq0.7
wordpress:wordpresswordpresseq0.71
wordpress:wordpresswordpresseq0.711
wordpress:wordpresswordpresseq1.0
wordpress:wordpresswordpresseq1.0.1
wordpress:wordpresswordpresseq1.0.2
wordpress:wordpresswordpresseq1.2

CPE	Name	Operator	Version
wordpress:wordpress	wordpress	le	2.2.2
wordpress:wordpress	wordpress	eq	0.6.2
wordpress:wordpress	wordpress	eq	0.6.2.1
wordpress:wordpress	wordpress	eq	0.7
wordpress:wordpress	wordpress	eq	0.71
wordpress:wordpress	wordpress	eq	0.711
wordpress:wordpress	wordpress	eq	1.0
wordpress:wordpress	wordpress	eq	1.0.1
wordpress:wordpress	wordpress	eq	1.0.2
wordpress:wordpress	wordpress	eq	1.2