CVE

Id
15667  
CVE No.
CVE-2005-4463  
Status
Candidate  
Description
WordPress before 1.5.2 allows remote attackers to obtain sensitive information via a direct request to (1) wp-includes/vars.php, (2) wp-content/plugins/hello.php, (3) wp-admin/upgrade-functions.php, (4) wp-admin/edit-form.php, (5) wp-settings.php, and (6) wp-admin/edit-form-comment.php, which leaks the path in an error message related to undefined functions or failed includes. NOTE: the wp-admin/menu-header.php vector is already covered by CVE-2005-2110. NOTE: the vars.php, edit-form.php, wp-settings.php, and edit-form-comment.php vectors were also reported to affect WordPress 2.0.1.  
Phase
Assigned (20051221)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
122892 15667 CVE-2005-4463 BUGTRAQ:20051220 [ECHO_ADV_24$2005] Full path disclosure on WordPress < 1.5.2  View
122893 15667 CVE-2005-4463 URL:http://www.securityfocus.com/archive/1/archive/1/419999/100/0/threaded  View
122894 15667 CVE-2005-4463 BUGTRAQ:20051221 [ECHO_ADV_24$2005] Full path disclosure on WordPress < 1.5.2  View
122895 15667 CVE-2005-4463 URL:http://www.securityfocus.com/archive/1/archive/1/419994/100/0/threaded  View
122896 15667 CVE-2005-4463 MISC:http://echo.or.id/adv/adv24-theday-2005.txt  View
122897 15667 CVE-2005-4463 BUGTRAQ:20060227 WordPress 2.0.1 Multiple Vulnerabilities  View
122898 15667 CVE-2005-4463 URL:http://www.securityfocus.com/archive/1/archive/1/426304/100/0/threaded  View
122899 15667 CVE-2005-4463 MISC:http://NeoSecurityTeam.net/advisories/Advisory-17.txt  View
122900 15667 CVE-2005-4463 SREASON:286  View

Related JVN