SecPod SCAP Repo, a repository of SCAP Content (CVE, CCE, CPE, CWE, OVAL and XCCDF)

Download | Alert*

CVE

CVE-2011-0701

wp-admin/async-upload.php in the media uploader in WordPress before 3.0.5 allows remote authenticated users to read (1) draft posts or (2) private posts via a modified attachment_id parameter.

CVSS Score and Metrics +CVSS Score and Metrics -

CVSS V2 Severity:
CVSS Score : 4.0
Exploit Score: 8.0
Impact Score: 2.9

CVSS V2 Metrics:
Access Vector: NETWORK
Access Complexity: LOW
Authentication: SINGLE
Confidentiality: PARTIAL
Integrity: NONE
Availability: NONE

Reference:

http://openwall.com/lists/oss-security/2011/02/08/7

http://openwall.com/lists/oss-security/2011/02/09/13

http://codex.wordpress.org/Version_3.0.5

http://core.trac.wordpress.org/changeset/17393

http://www.wordpress.org/news/2011/02/wordpress-3-0-5/


30430



423868



247621



909



194512



282