wp-admin/admin.php in WordPress and WordPress MU before 2.8.1 does not require administrative authentication to access the configuration of a plugin, which allows remote attackers to specify a configuration file in the page parameter to obtain sensitive information or modify this file, as demonstrated by the (1) collapsing-archives/options.txt, (2) akismet/readme.txt, (3) related-ways-to-take-action/options.php, (4) wp-security-scan/securityscan.php, and (5) wp-ids/ids-admin.php files. NOTE: this can be leveraged for cross-site scripting (XSS) and denial of service.

Several vulnerabilities have been discovered in wordpress, weblog manager. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2008-6762     It was discovered that wordpress is prone to an open     redirect vulnerability which allows remote attackers to     conduct phishing attacks.

  - CVE-2008-6767     It was discovered that remote attackers had the ability     to trigger an application upgrade, which could lead to a     denial of service attack.

  - CVE-2009-2334     It was discovered that wordpress lacks authentication     checks in the plugin configuration, which might leak     sensitive information.

  - CVE-2009-2854     It was discovered that wordpress lacks authentication     checks in various actions, thus allowing remote     attackers to produce unauthorised edits or additions.

  - CVE-2009-2851     It was discovered that the administrator interface is     prone to a cross-site scripting attack.

  - CVE-2009-2853     It was discovered that remote attackers can gain     privileges via certain direct requests.

  - CVE-2008-1502     It was discovered that the _bad_protocol_once function     in KSES, as used by wordpress, allows remote attackers     to perform cross-site scripting attacks.

  - CVE-2008-4106     It was discovered that wordpress lacks certain checks     around user information, which could be used by     attackers to change the password of a user.

  - CVE-2008-4769     It was discovered that the get_category_template     function is prone to a directory traversal     vulnerability, which could lead to the execution of     arbitrary code.

  - CVE-2008-4796     It was discovered that the _httpsrequest function in the     embedded snoopy version is prone to the execution of     arbitrary commands via shell metacharacters in https     URLs.

  - CVE-2008-5113     It was discovered that wordpress relies on the REQUEST     superglobal array in certain dangerous situations, which     makes it easier to perform attacks via crafted cookies.

Update spans MU-versions for the following security releases from upstream:
http://wordpress.org/development/2009/08/2-8-4-security-release/ http://wordpress.org/development/2009/08/wordpress-2-8-3-security-rele ase/

  - Backport of XSS fixes from WordPress 2.8.2 * Backport of     security fixes for admin.php?page= bugs (CVE-2009-2334)     Backport of security fixes for admin.php?page= bugs     (CVE-2009-2334) Backport of security fixes for     admin.php?page= bugs (CVE-2009-2334)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Fri Jul 10 2009 Adrian Reber <adrian at lisas.de> -     2.8.1-1

    - updated to 2.8.1 for security fixes - BZ 510745

    - Mon Jun 22 2009 Adrian Reber <adrian at lisas.de> -       2.8-1

    - updated to 2.8

    - Wed Feb 25 2009 Fedora Release Engineering <rel-eng at       lists.fedoraproject.org> - 2.7.1-2

    - Rebuilt for       https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild

    - Wed Feb 11 2009 Adrian Reber <adrian at lisas.de> -       2.7.1-1

    - updated to 2.7.1

    - Wed Nov 26 2008 Adrian Reber <adrian at lisas.de> -       2.6.5-2

    - updated to 2.6.5

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Fri Jul 10 2009 Adrian Reber <adrian at lisas.de> -     2.8.1-1

    - updated to 2.8.1 for security fixes - BZ 510745

    - Mon Jun 22 2009 Adrian Reber <adrian at lisas.de> -       2.8-1

    - updated to 2.8

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of WordPress earlier than 2.8.1. Such versions are reportedly affected by multiple vulnerabilities : 

  - A username enumeration weakness caused by the application displaying different responses to login requests depending on the existence of the supplied username. (CVE-2009-2334)

  - A security-bypass vulnerability in the 'wp-admin/admin.php' script when it is called with the 'pages' parameter set to a plug-in configuration page. An authenticated attacker could exploit this to gain access to configuration scripts. (CVE-2009-2335)

ID	Name	Product	Family	Severity
44736	Debian DSA-1871-1 : wordpress - several vulnerabilities	Nessus	Debian Local Security Checks	critical
40601	Fedora 10 : wordpress-mu-2.8.4a-1.fc10 (2009-8538)	Nessus	Fedora Local Security Checks	medium
40599	Fedora 11 : wordpress-mu-2.8.4a-1.fc11 (2009-8529)	Nessus	Fedora Local Security Checks	medium
39859	Fedora 10 : wordpress-2.8.1-1.fc10 (2009-7729)	Nessus	Fedora Local Security Checks	medium
39856	Fedora 11 : wordpress-2.8.1-1.fc11 (2009-7701)	Nessus	Fedora Local Security Checks	medium
5096	WordPress < 2.8.1 Multiple Vulnerabilities	Nessus Network Monitor	CGI	medium

Detections

Analytics

CVE-2009-2334

medium

Tenable Plugins

critical

medium

medium

medium

medium

medium