CVE-2006-3389
published 2006-07-06CVE-2006-3389: index.php in WordPress 2.0.3 allows remote attackers to obtain sensitive information, such as SQL table prefixes, via an invalid paged parameter, which…
PriorityP416medium5CVSS 2.0
AVNACLAuNCPINAN
EPSS
2.89%
85.4th percentile
index.php in WordPress 2.0.3 allows remote attackers to obtain sensitive information, such as SQL table prefixes, via an invalid paged parameter, which displays the information in an SQL error message. NOTE: this issue has been disputed by a third party who states that the issue does not leak any target-specific information.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | wordpress | < wordpress 2.0.4-1 (bookworm) | wordpress 2.0.4-1 (bookworm) |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | >= 0 < 2.0.4-1 | 2.0.4-1 |
| wordpress | wordpress | >= 0 < 2.0.4-1 | 2.0.4-1 |
| wordpress | wordpress | >= 0 < 2.0.4-1 | 2.0.4-1 |
| wordpress | wordpress | >= 0 < 2.0.4-1 | 2.0.4-1 |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
osv5.0MEDIUM
vendor_debian5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-2m32-3qgh-qc3p: index
ghsa_unreviewed·2022-05-01
CVE-2006-3389 [MEDIUM] GHSA-2m32-3qgh-qc3p: index
index.php in WordPress 2.0.3 allows remote attackers to obtain sensitive information, such as SQL table prefixes, via an invalid paged parameter, which displays the information in an SQL error message. NOTE: this issue has been disputed by a third party who states that the issue does not leak any target-specific information.
GHSA
GHSA-5fp4-c42w-xqf3: Multiple unspecified vulnerabilities in WordPress before 2
ghsa_unreviewed·2022-05-01·CVSS 5.0
CVE-2006-4028 [MEDIUM] GHSA-5fp4-c42w-xqf3: Multiple unspecified vulnerabilities in WordPress before 2
Multiple unspecified vulnerabilities in WordPress before 2.0.4 have unknown impact and remote attack vectors. NOTE: due to lack of details, it is not clear how these issues are different from CVE-2006-3389 and CVE-2006-3390, although it is likely that 2.0.4 addresses an unspecified issue related to "Anyone can register" functionality (user registration for guests).
OSV
CVE-2006-4028: Multiple unspecified vulnerabilities in WordPress before 2
osv·2006-08-09·CVSS 5.0
CVE-2006-4028 [MEDIUM] CVE-2006-4028: Multiple unspecified vulnerabilities in WordPress before 2
Multiple unspecified vulnerabilities in WordPress before 2.0.4 have unknown impact and remote attack vectors. NOTE: due to lack of details, it is not clear how these issues are different from CVE-2006-3389 and CVE-2006-3390, although it is likely that 2.0.4 addresses an unspecified issue related to "Anyone can register" functionality (user registration for guests).
OSV
CVE-2006-3389: index
osv·2006-07-06·CVSS 5.0
CVE-2006-3389 [MEDIUM] CVE-2006-3389: index
index.php in WordPress 2.0.3 allows remote attackers to obtain sensitive information, such as SQL table prefixes, via an invalid paged parameter, which displays the information in an SQL error message. NOTE: this issue has been disputed by a third party who states that the issue does not leak any target-specific information.
Debian
CVE-2006-3389: wordpress - index.php in WordPress 2.0.3 allows remote attackers to obtain sensitive informa...
vendor_debian·2006·CVSS 5.0
CVE-2006-3389 [MEDIUM] CVE-2006-3389: wordpress - index.php in WordPress 2.0.3 allows remote attackers to obtain sensitive informa...
index.php in WordPress 2.0.3 allows remote attackers to obtain sensitive information, such as SQL table prefixes, via an invalid paged parameter, which displays the information in an SQL error message. NOTE: this issue has been disputed by a third party who states that the issue does not leak any target-specific information.
Scope: local
bookworm: resolved (fixed in 2.0.4-1)
bullseye: resolved (fixed in 2.0.4-1)
forky: resolved (fixed in 2.0.4-1)
sid: resolved (fixed in 2.0.4-1)
trixie: resolved (fixed in 2.0.4-1)
Debian
CVE-2006-4028: wordpress - Multiple unspecified vulnerabilities in WordPress before 2.0.4 have unknown impa...
vendor_debian·2006·CVSS 5.0
CVE-2006-4028 [MEDIUM] CVE-2006-4028: wordpress - Multiple unspecified vulnerabilities in WordPress before 2.0.4 have unknown impa...
Multiple unspecified vulnerabilities in WordPress before 2.0.4 have unknown impact and remote attack vectors. NOTE: due to lack of details, it is not clear how these issues are different from CVE-2006-3389 and CVE-2006-3390, although it is likely that 2.0.4 addresses an unspecified issue related to "Anyone can register" functionality (user registration for guests).
Scope: local
bookworm: resolved (fixed in 2.0.4-1)
bullseye: resolved (fixed in 2.0.4-1)
forky: resolved (fixed in 2.0.4-1)
sid: resolved (fixed in 2.0.4-1)
trixie: resolved (fixed in 2.0.4-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://secunia.com/advisories/20928http://secunia.com/advisories/21447http://security.gentoo.org/glsa/glsa-200608-19.xmlhttp://securityreason.com/securityalert/1187http://www.securityfocus.com/archive/1/438942/100/0/threadedhttp://www.securityfocus.com/archive/1/439031/100/0/threadedhttp://www.securityfocus.com/archive/1/439062/100/0/threadedhttp://www.securityfocus.com/archive/1/440127/100/0/threadedhttp://www.securityfocus.com/bid/18779http://www.vupen.com/english/advisories/2006/2661http://secunia.com/advisories/20928http://secunia.com/advisories/21447http://security.gentoo.org/glsa/glsa-200608-19.xmlhttp://securityreason.com/securityalert/1187http://www.securityfocus.com/archive/1/438942/100/0/threadedhttp://www.securityfocus.com/archive/1/439031/100/0/threadedhttp://www.securityfocus.com/archive/1/439062/100/0/threadedhttp://www.securityfocus.com/archive/1/440127/100/0/threadedhttp://www.securityfocus.com/bid/18779http://www.vupen.com/english/advisories/2006/2661
2006-07-06
Published