Description

wp-admin/includes/class-wp-posts-list-table.php in WordPress before 3.3.3 does not properly restrict excerpt-view access, which allows remote authenticated users to obtain sensitive information by visiting a draft.

Remediation

References

CVE-2012-6635

Related Vulnerabilities

Moodle Permissions, Privileges, and Access Controls Vulnerability (CVE-2011-4584)

WordPress Configuration Vulnerability (CVE-2009-2336)

WordPress Plugin User Registration-Custom Registration Form, Login Form And User Profile Arbitrary File Upload (3.0.2)

Oracle Database Server CVE-2007-2110 Vulnerability (CVE-2007-2110)

WordPress Plugin Popup box SQL Injection (2.3.3)

Severity

Medium

Classification

CVE-2012-6635 CWE-264

Tags

Missing Update Known Vulnerabilities