CVE-2006-4743

WordPress Core 2.0.2 - 2.0.5 - Sensitive Information Disclosure

2007-01-05 00:00
Anonymous

Strategic Overview

Status
Patched in 2.0.6
Affected Core
WordPress 2.0
Affected Version
2.0.2 – 2.0.5
CVSS
5.3Medium
Weakness type
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
CVE
CVE-2006-4743
View all WordPress 2.0 vulnerabilities

At a glance

CVE-2006-4743 is a medium-severity Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the WordPress 2.0 WordPress release line, affecting 2.0.2 – 2.0.5. It carries a CVSS score of 5.3 (reachable over the network; low attack complexity). Exploitation requires no authentication. The issue is fixed in version 2.0.6; sites on affected versions should update now. Disclosed January 2007.

Vulnerability Overview

WordPress 2.0.2 through 2.0.5 allows remote attackers to obtain sensitive information via a direct request for (1) 404.php, (2) akismet.php, (3) archive.php, (4) archives.php, (5) attachment.php, (6) blogger.php, (7) comments.php, (8) comments-popup.php, (9) dotclear.php, (10) footer.php, (11) functions.php, (12) header.php, (13) hello.php, (14) wp-content/themes/default/index.php, (15) links.php, (16) livejournal.php, (17) mt.php, (18) page.php, (19) rss.php, (20) searchform.php, (21) search.php, (22) sidebar.php, (23) single.php, (24) textpattern.php, (25) upgrade-functions.php, (26) upgrade-schema.php, or (27) wp-db-backup.php, which reveal the path in various error messages. NOTE: another researcher has disputed the details of this report, stating that version 2.0.5 does not exist. NOTE: the admin-footer.php, admin-functions.php, default-filters.php, edit-form-advanced.php, edit-link-form.php, edit-page-form.php, kses.php, locale.php, rss-functions.php, template-loader.php, and wp-db.php vectors are already covered by CVE-2006-0986. The edit-form-comment.php, vars.php, and wp-settings.php vectors are already covered by CVE-2005-4463. The menu-header.php vector is already covered by CVE-2005-2110.

Technical Analysis

The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no privileges on the target site, and no interaction from a victim user.

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Reaching this weakness in WordPress 2.0 2.0.2 – 2.0.5 takes a caller who can reach the endpoint. Sensitive information exposure means data the application intended to keep internal is returned to a caller who should not be able to see it.

The disclosed data — credentials, tokens, customer records or internal paths — is usually worth more as material for a follow-up attack than as an end in itself. For WordPress 2.0 the fix is 2.0.6: builds 2.0.2 – 2.0.5 are affected, anything from 2.0.6 onward is not.

Remediation

Update to version 2.0.6, or a newer patched version

How does WordSec protect against this?

The fix is the thing that ends this: updating to 2.0.6 is the step that ends it.

  • Alerts

External References

https://www.cve.org/CVERecord?id=CVE-2006-4743https://www.wordfence.com/threat-intel/vulnerabilities/id/f50bca0a-7089-4b4e-820f-d311fdb88cf1https://nvd.nist.gov/vuln/detail/CVE-2006-4743

Related records

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C