4.3

CVE-2013-2203

WordPress Core < 3.5.2 - Sensitive Information Disclosure

WordPress before 3.5.2, when the uploads directory forbids write access, allows remote attackers to obtain sensitive information via an invalid upload request, which reveals the absolute path in an XMLHttpRequest error message.
Mögliche Gegenmaßnahme
WordPress: Update to version 3.5.2, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Wordpress ≫ Wordpress Version <= 3.5.1
Wordpress ≫ Wordpress Version 0.71
Wordpress ≫ Wordpress Version 1.0
Wordpress ≫ Wordpress Version 1.0.1
Wordpress ≫ Wordpress Version 1.0.2
Wordpress ≫ Wordpress Version 1.1.1
Wordpress ≫ Wordpress Version 1.2
Wordpress ≫ Wordpress Version 1.2.1
Wordpress ≫ Wordpress Version 1.2.2
Wordpress ≫ Wordpress Version 1.2.3
Wordpress ≫ Wordpress Version 1.2.4
Wordpress ≫ Wordpress Version 1.2.5
Wordpress ≫ Wordpress Version 1.2.5 Update a
Wordpress ≫ Wordpress Version 1.3
Wordpress ≫ Wordpress Version 1.3.2
Wordpress ≫ Wordpress Version 1.3.3
Wordpress ≫ Wordpress Version 1.5
Wordpress ≫ Wordpress Version 1.5.1
Wordpress ≫ Wordpress Version 1.5.1.1
Wordpress ≫ Wordpress Version 1.5.1.2
Wordpress ≫ Wordpress Version 1.5.1.3
Wordpress ≫ Wordpress Version 1.5.2
Wordpress ≫ Wordpress Version 1.6.2
Wordpress ≫ Wordpress Version 2.0
Wordpress ≫ Wordpress Version 2.0.1
Wordpress ≫ Wordpress Version 2.0.2
Wordpress ≫ Wordpress Version 2.0.4
Wordpress ≫ Wordpress Version 2.0.5
Wordpress ≫ Wordpress Version 2.0.6
Wordpress ≫ Wordpress Version 2.0.7
Wordpress ≫ Wordpress Version 2.0.8
Wordpress ≫ Wordpress Version 2.0.9
Wordpress ≫ Wordpress Version 2.0.10
Wordpress ≫ Wordpress Version 2.0.11
Wordpress ≫ Wordpress Version 2.1
Wordpress ≫ Wordpress Version 2.1.1
Wordpress ≫ Wordpress Version 2.1.2
Wordpress ≫ Wordpress Version 2.1.3
Wordpress ≫ Wordpress Version 2.2
Wordpress ≫ Wordpress Version 2.2.1
Wordpress ≫ Wordpress Version 2.2.2
Wordpress ≫ Wordpress Version 2.2.3
Wordpress ≫ Wordpress Version 2.3
Wordpress ≫ Wordpress Version 2.3.1
Wordpress ≫ Wordpress Version 2.3.2
Wordpress ≫ Wordpress Version 2.3.3
Wordpress ≫ Wordpress Version 2.5
Wordpress ≫ Wordpress Version 2.5.1
Wordpress ≫ Wordpress Version 2.6
Wordpress ≫ Wordpress Version 2.6.1
Wordpress ≫ Wordpress Version 2.6.2
Wordpress ≫ Wordpress Version 2.6.3
Wordpress ≫ Wordpress Version 2.6.5
Wordpress ≫ Wordpress Version 2.7
Wordpress ≫ Wordpress Version 2.7.1
Wordpress ≫ Wordpress Version 2.8
Wordpress ≫ Wordpress Version 2.8.1
Wordpress ≫ Wordpress Version 2.8.2
Wordpress ≫ Wordpress Version 2.8.3
Wordpress ≫ Wordpress Version 2.8.4
Wordpress ≫ Wordpress Version 2.8.4 Update a
Wordpress ≫ Wordpress Version 2.8.5
Wordpress ≫ Wordpress Version 2.8.5.1
Wordpress ≫ Wordpress Version 2.8.5.2
Wordpress ≫ Wordpress Version 2.8.6
Wordpress ≫ Wordpress Version 2.9
Wordpress ≫ Wordpress Version 2.9.1
Wordpress ≫ Wordpress Version 2.9.1.1
Wordpress ≫ Wordpress Version 2.9.2
Wordpress ≫ Wordpress Version 3.3
Wordpress ≫ Wordpress Version 3.3.1
Wordpress ≫ Wordpress Version 3.3.2
Wordpress ≫ Wordpress Version 3.3.3
Wordpress ≫ Wordpress Version 3.4.0
Wordpress ≫ Wordpress Version 3.4.1
Wordpress ≫ Wordpress Version 3.4.2
Wordpress ≫ Wordpress Version 3.5.0
Weitere Schwachstelleninformationen
SystemWordPress Core
≫
Produkt WordPress
Version *-3.5.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.03% 0.785
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:P/I:N/A:N
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://codex.wordpress.org/Version_3.5.2
http://wordpress.org/news/2013/06/wordpress-3-5-2/
Vendor Advisory
http://www.debian.org/security/2013/dsa-2718
https://bugzilla.redhat.com/show_bug.cgi?id=976784
https://www.wordfence.com/threat-intel/vulnerabilities/id/d5f1ceb3-34b6-4d97-9787-d52a92f84662
Third Party Advisory