Description

Wordpress 1.5 and earlier allows remote attackers to obtain sensitive information via a direct request to files in (1) wp-content/themes/, (2) wp-includes/, or (3) wp-admin/, which reveal the path in an error message.

Remediation

References

CVE-2005-1688

Related Vulnerabilities

Apache HTTP Server Other Vulnerability (CVE-2004-0942)

WordPress Plugin SE HTML5 Album Audio Player Directory Traversal (1.1.0)

Zenphoto Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2012-4519)

Atlassian Jira Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2021-39124)

CubeCart Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2010-4903)

Severity

Medium

Classification

CVE-2005-1688 CWE-425

Tags

Missing Update Known Vulnerabilities