CVE-2011-0701

2011-03-1419:55:00

Debian Security Bug Tracker

security-tracker.debian.org

4 Medium

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

0.002 Low

EPSS

Percentile

54.0%

JSON

wp-admin/async-upload.php in the media uploader in WordPress before 3.0.5 allows remote authenticated users to read (1) draft posts or (2) private posts via a modified attachment_id parameter.

OSVersionArchitecturePackageVersionFilename
Debian12allwordpress< 3.0.5+dfsg-1wordpress_3.0.5+dfsg-1_all.deb
Debian11allwordpress< 3.0.5+dfsg-1wordpress_3.0.5+dfsg-1_all.deb
Debian10allwordpress< 3.0.5+dfsg-1wordpress_3.0.5+dfsg-1_all.deb
Debian999allwordpress< 3.0.5+dfsg-1wordpress_3.0.5+dfsg-1_all.deb
Debian13allwordpress< 3.0.5+dfsg-1wordpress_3.0.5+dfsg-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	wordpress	< 3.0.5+dfsg-1	wordpress_3.0.5+dfsg-1_all.deb
Debian	11	all	wordpress	< 3.0.5+dfsg-1	wordpress_3.0.5+dfsg-1_all.deb
Debian	10	all	wordpress	< 3.0.5+dfsg-1	wordpress_3.0.5+dfsg-1_all.deb
Debian	999	all	wordpress	< 3.0.5+dfsg-1	wordpress_3.0.5+dfsg-1_all.deb
Debian	13	all	wordpress	< 3.0.5+dfsg-1	wordpress_3.0.5+dfsg-1_all.deb