Description

wp-includes/vars.php in Wordpress before 2.2.3 does not properly extract the current path from the PATH_INFO ($PHP_SELF), which allows remote attackers to bypass intended access restrictions for certain pages.

Remediation

References

CVE-2008-2146

Related Vulnerabilities

WordPress Plugin Calendar by WD-Responsive Event Calendar for WordPress Multiple Cross-Site Scripting and SQL Injection Vulnerabilities (1.3.0)

PHP version older than 5.2.1

MediaWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2012-4377)

WordPress Plugin Software License Manager Cross-Site Scripting (4.4.7)

WordPress Plugin Best Image Gallery & Responsive Photo Gallery-FooGallery Cross-Site Scripting (1.9.24)

Severity

High

Classification

CVE-2008-2146 CWE-264

Tags

Missing Update Known Vulnerabilities