Description
WordPress 2.2.x and 2.3.x allows remote attackers to obtain sensitive information via an invalid p parameter in an rss2 action to the default URI, which reveals the full path and the SQL database structure.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | wordpress | No fix yet | — |
| Debian 13 | wordpress | No fix yet | — |
| Debian 12 | wordpress | No fix yet | — |
References
- http://securityvulns.ru/Sdocument663.html
- 20080103 securityvulns.com russian vulnerabilities digest mailing-list
- wordpress-p-path-disclosure(39423) vdb-entry
- 20080103 securityvulns.com russian vulnerabilities digest mailing-list
- 3539 third-party-advisory
- http://websecurity.com.ua/1634/