Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
9.3
CVSSv2

CVE-2008-4769

Published: 28/10/2008 Updated: 08/08/2017
CVSS v2 Base Score: 9.3 | Impact Score: 10 | Exploitability Score: 8.6
VMScore: 935
Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Subscribe to Wordpress

Vulnerability Summary

Directory traversal vulnerability in the get_category_template function in wp-includes/theme.php in WordPress 2.3.3 and previous versions, and 2.5, allows remote malicious users to include and possibly execute arbitrary PHP files via the cat parameter in index.php. NOTE: some of these details are obtained from third party information.

Vulnerable Product Search on Vulmon Subscribe to Product

wordpress wordpress 1.2-delta

wordpress wordpress 2.1.3

wordpress wordpress 1.0.1-miles

wordpress wordpress 1.5-strayhorn

wordpress wordpress 1.5.1.2

wordpress wordpress 1.5.1.3

wordpress wordpress 2.0.2

wordpress wordpress 2.0.3

wordpress wordpress 2.0.4

wordpress wordpress 2.3

wordpress wordpress 1.2

wordpress wordpress 2.2_revision5003

wordpress wordpress 2.2.2

wordpress wordpress 1.0

wordpress wordpress 1.0.1

wordpress wordpress 0.7

wordpress wordpress 0.72

wordpress wordpress 1.4

wordpress wordpress 1.2-mingus

wordpress wordpress 2.2_revision5002

wordpress wordpress 1.0.2-blakey

wordpress wordpress 1.5.1.1

wordpress wordpress 2.2.0

wordpress wordpress 2.3.2

wordpress wordpress 2.0.1

wordpress wordpress 2.0.7

wordpress wordpress 2.1

wordpress wordpress 2.3.1

wordpress wordpress 1.2.1

wordpress wordpress 1.2.2

wordpress wordpress 0.6.2.1

wordpress wordpress

wordpress wordpress 2.5

wordpress wordpress 2.0.11

wordpress wordpress 2.1.3_rc1

wordpress wordpress 2.0.9

wordpress wordpress 2.2

wordpress wordpress 1.3.1

wordpress wordpress 2.0.10

wordpress wordpress 2.0.10_rc1

wordpress wordpress 2.1.1

wordpress wordpress 2.1.2

wordpress wordpress 2.0.10_rc2

wordpress wordpress 2.1.3_rc2

wordpress wordpress 1.0.2

wordpress wordpress 0.6.2

wordpress wordpress 0.711

wordpress wordpress 2.2.3

wordpress wordpress 1.0-platinum

wordpress wordpress 2.0.8

wordpress wordpress 2.2.1

wordpress wordpress 0.71-gold

wordpress wordpress 1.5.2

wordpress wordpress 2.0

wordpress wordpress 2.0.5

wordpress wordpress 2.0.6

wordpress wordpress 1.5

wordpress wordpress 1.5.1

wordpress wordpress 0.71

wordpress wordpress 1.6

Vendor Advisories

Debian Security Advisories: DSA-1871-1 wordpress -- several vulnerabilities
Several vulnerabilities have been discovered in wordpress, weblog manager The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2008-6762 It was discovered that wordpress is prone to an open redirect vulnerability which allows remote attackers to conduct phishing atacks CVE-2008-6767 It was discovered that remot ...
Debian CVElist Bug Report Logs: wordpress can be subject of delayed attacks via cookies
Debian Bug report logs - #504771 wordpress can be subject of delayed attacks via cookies Package: wordpress; Maintainer for wordpress is Craig Small <csmall@debianorg>; Source for wordpress is src:wordpress (PTS, buildd, popcon) Reported by: Raphael Geissert <atomo64@gmailcom> Date: Fri, 7 Nov 2008 02:42:04 UTC S ...
Debian CVElist Bug Report Logs: wordpress: CORE-2009-0515 priviledges unchecked and multiple information disclosures
Debian Bug report logs - #536724 wordpress: CORE-2009-0515 priviledges unchecked and multiple information disclosures Package: wordpress; Maintainer for wordpress is Craig Small <csmall@debianorg>; Source for wordpress is src:wordpress (PTS, buildd, popcon) Reported by: "Michael S Gilbert" <michaelsgilbert@gmailcom&g ...
Debian CVElist Bug Report Logs: CVE-2008-6767, CVE-2008-6762
Debian Bug report logs - #531736 CVE-2008-6767, CVE-2008-6762 Package: wordpress; Maintainer for wordpress is Craig Small <csmall@debianorg>; Source for wordpress is src:wordpress (PTS, buildd, popcon) Reported by: Giuseppe Iuculano <giuseppe@iuculanoit> Date: Wed, 3 Jun 2009 17:27:02 UTC Severity: normal Tags: s ...

Exploits

Exploit DB: WordPress 2.3.3 - 'cat' Directory Traversal
source: wwwsecurityfocuscom/bid/28845/info WordPress is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data Exploiting the issue may allow an attacker to access sensitive information that could aid in further attacks WordPress 233 is vulnerable; other versions may also be a ...

References

CWE-22http://www.juniper.fi/security/auto/vulnerabilities/vuln28845.htmlhttp://secunia.com/advisories/29949http://www.securityfocus.com/bid/28845http://trac.wordpress.org/changeset/7586http://www.debian.org/security/2009/dsa-1871https://exchange.xforce.ibmcloud.com/vulnerabilities/41920https://nvd.nist.govhttps://www.debian.org/security/./dsa-1871https://www.exploit-db.com/exploits/31670/
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2022-38028CVE-2024-32406CVE-2024-25624IMAPCVE-2024-2310CVE-2024-0874CVE-2024-20359XXEremote code execution
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook