Thursday, December 20, 2007 10:58 AM
cmosby
WordPress Draft Information Disclosure - Advisories - Secunia
WordPress Draft Information Disclosure
Secunia Advisory:
SA28130
Release Date:
2007-12-19
Critical:
Less critical
Impact:
Security Bypass
Exposure of sensitive information
Where:
From remote
Solution Status:
Unpatched
Software:
WordPress 2.x
Description:
Michael Brooks has discovered a vulnerability in WordPress, which can be exploited by malicious people to bypass certain security restrictions and to disclose sensitive information.
The application does not properly restrict access to posted drafts to users with valid administrator credentials. This can be exploited to read drafts by accessing the index.php script with data in the "PATH_INFO" URL part ending with "wp-admin/".
Examples:
http://[host]/[path]/index.php/wp-admin/
http://[host]/[path]/index.php/test-wp-admin/
The vulnerability is confirmed in version 2.3.1. Other versions may also be affected.
Solution:
Do not post sensitive information as drafts.
Provided and/or discovered by:
Michael Brooks
Source: WordPress Draft Information Disclosure - Advisories - Secunia
Filed under: Blogging, Internet Applications, Security