CVE-2006-0986

WordPress Core < 2.0.2 - Sensitive Information Disclosure

2006-03-10 00:00
Anonymous

Strategic Overview

Status
Patched in 2.0.2
Affected Core
WordPress 2.0
Affected Version
<= 2.0.1
CVSS
7.5High
Weakness type
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
CVE
CVE-2006-0986
View all WordPress 2.0 vulnerabilities

At a glance

CVE-2006-0986 is a high-severity Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the WordPress 2.0 WordPress release line, affecting <= 2.0.1. It carries a CVSS score of 7.5 (reachable over the network; low attack complexity; high confidentiality impact). Exploitation requires no authentication. The issue is fixed in version 2.0.2; sites on affected versions should update now. Disclosed March 2006.

Vulnerability Overview

WordPress 2.0.1 and earlier allows remote attackers to obtain sensitive information via a direct request to (1) default-filters.php, (2) template-loader.php, (3) rss-functions.php, (4) locale.php, (5) wp-db.php, and (6) kses.php in the wp-includes/ directory; and (7) edit-form-advanced.php, (8) admin-functions.php, (9) edit-link-form.php, (10) edit-page-form.php, (11) admin-footer.php, and (12) menu.php in the wp-admin directory; and possibly (13) list directory contents of the wp-includes directory. NOTE: the vars.php, edit-form.php, wp-settings.php, and edit-form-comment.php vectors are already covered by CVE-2005-4463. The menu-header.php vector is already covered by CVE-2005-2110. Other vectors might be covered by CVE-2005-1688. NOTE: if the typical installation of WordPress does not list any site-specific files to wp-includes, then vector [13] is not an exposure.

Technical Analysis

The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no privileges on the target site, and no interaction from a victim user. A successful exploit has high impact on confidentiality.

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Reaching this weakness in WordPress 2.0 <= 2.0.1 takes a caller who can reach the endpoint. Sensitive information exposure means data the application intended to keep internal is returned to a caller who should not be able to see it.

The disclosed data — credentials, tokens, customer records or internal paths — is usually worth more as material for a follow-up attack than as an end in itself. For WordPress 2.0 the fix is 2.0.2: builds <= 2.0.1 are affected, anything from 2.0.2 onward is not.

Remediation

Update to version 2.0.2, or a newer patched version

How does WordSec protect against this?

The fix is the thing that ends this: updating to 2.0.2 is the step that ends it.

  • Alerts

External References

https://www.cve.org/CVERecord?id=CVE-2006-0986https://www.wordfence.com/threat-intel/vulnerabilities/id/06e4d7e3-c800-4b3d-9504-c69aa9a918fbhttps://nvd.nist.gov/vuln/detail/CVE-2006-0986

Related records

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C