CVE-2006-3390
published 2006-07-06CVE-2006-3390: WordPress 2.0.3 allows remote attackers to obtain the installation path via a direct request to various files, such as those in the (1) wp-admin, (2)…
PriorityP421medium5CVSS 2.0
AVNACLAuNCPINAN
EPSS
2.81%
84.9th percentile
WordPress 2.0.3 allows remote attackers to obtain the installation path via a direct request to various files, such as those in the (1) wp-admin, (2) wp-content, and (3) wp-includes directories, possibly due to uninitialized variables.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | wordpress | < wordpress 2.0.4-1 (bookworm) | wordpress 2.0.4-1 (bookworm) |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | >= 0 < 2.0.4-1 | 2.0.4-1 |
| wordpress | wordpress | >= 0 < 2.0.4-1 | 2.0.4-1 |
| wordpress | wordpress | >= 0 < 2.0.4-1 | 2.0.4-1 |
| wordpress | wordpress | >= 0 < 2.0.4-1 | 2.0.4-1 |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
osv5.0MEDIUM
vendor_debian5.0LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-p47w-r74f-f3j5: WordPress 2
ghsa_unreviewed·2022-05-01
CVE-2006-3390 [MEDIUM] GHSA-p47w-r74f-f3j5: WordPress 2
WordPress 2.0.3 allows remote attackers to obtain the installation path via a direct request to various files, such as those in the (1) wp-admin, (2) wp-content, and (3) wp-includes directories, possibly due to uninitialized variables.
GHSA
GHSA-5fp4-c42w-xqf3: Multiple unspecified vulnerabilities in WordPress before 2
ghsa_unreviewed·2022-05-01·CVSS 5.0
CVE-2006-4028 [MEDIUM] GHSA-5fp4-c42w-xqf3: Multiple unspecified vulnerabilities in WordPress before 2
Multiple unspecified vulnerabilities in WordPress before 2.0.4 have unknown impact and remote attack vectors. NOTE: due to lack of details, it is not clear how these issues are different from CVE-2006-3389 and CVE-2006-3390, although it is likely that 2.0.4 addresses an unspecified issue related to "Anyone can register" functionality (user registration for guests).
OSV
CVE-2006-4028: Multiple unspecified vulnerabilities in WordPress before 2
osv·2006-08-09·CVSS 5.0
CVE-2006-4028 [MEDIUM] CVE-2006-4028: Multiple unspecified vulnerabilities in WordPress before 2
Multiple unspecified vulnerabilities in WordPress before 2.0.4 have unknown impact and remote attack vectors. NOTE: due to lack of details, it is not clear how these issues are different from CVE-2006-3389 and CVE-2006-3390, although it is likely that 2.0.4 addresses an unspecified issue related to "Anyone can register" functionality (user registration for guests).
OSV
CVE-2006-3390: WordPress 2
osv·2006-07-06·CVSS 5.0
CVE-2006-3390 [MEDIUM] CVE-2006-3390: WordPress 2
WordPress 2.0.3 allows remote attackers to obtain the installation path via a direct request to various files, such as those in the (1) wp-admin, (2) wp-content, and (3) wp-includes directories, possibly due to uninitialized variables.
Debian
CVE-2006-4028: wordpress - Multiple unspecified vulnerabilities in WordPress before 2.0.4 have unknown impa...
vendor_debian·2006·CVSS 5.0
CVE-2006-4028 [MEDIUM] CVE-2006-4028: wordpress - Multiple unspecified vulnerabilities in WordPress before 2.0.4 have unknown impa...
Multiple unspecified vulnerabilities in WordPress before 2.0.4 have unknown impact and remote attack vectors. NOTE: due to lack of details, it is not clear how these issues are different from CVE-2006-3389 and CVE-2006-3390, although it is likely that 2.0.4 addresses an unspecified issue related to "Anyone can register" functionality (user registration for guests).
Scope: local
bookworm: resolved (fixed in 2.0.4-1)
bullseye: resolved (fixed in 2.0.4-1)
forky: resolved (fixed in 2.0.4-1)
sid: resolved (fixed in 2.0.4-1)
trixie: resolved (fixed in 2.0.4-1)
Debian
CVE-2006-3390: wordpress - WordPress 2.0.3 allows remote attackers to obtain the installation path via a di...
vendor_debian·2006·CVSS 5.0
CVE-2006-3390 [MEDIUM] CVE-2006-3390: wordpress - WordPress 2.0.3 allows remote attackers to obtain the installation path via a di...
WordPress 2.0.3 allows remote attackers to obtain the installation path via a direct request to various files, such as those in the (1) wp-admin, (2) wp-content, and (3) wp-includes directories, possibly due to uninitialized variables.
Scope: local
bookworm: resolved (fixed in 2.0.4-1)
bullseye: resolved (fixed in 2.0.4-1)
forky: resolved (fixed in 2.0.4-1)
sid: resolved (fixed in 2.0.4-1)
trixie: resolved (fixed in 2.0.4-1)
No detection rules found.
No public exploits indexed.
http://secunia.com/advisories/20928http://secunia.com/advisories/21447http://security.gentoo.org/glsa/glsa-200608-19.xmlhttp://securityreason.com/securityalert/1187http://www.securityfocus.com/archive/1/438942/100/0/threadedhttp://www.securityfocus.com/archive/1/439062/100/0/threadedhttp://www.securityfocus.com/bid/18779http://www.vupen.com/english/advisories/2006/2661http://secunia.com/advisories/20928http://secunia.com/advisories/21447http://security.gentoo.org/glsa/glsa-200608-19.xmlhttp://securityreason.com/securityalert/1187http://www.securityfocus.com/archive/1/438942/100/0/threadedhttp://www.securityfocus.com/archive/1/439062/100/0/threadedhttp://www.securityfocus.com/bid/18779http://www.vupen.com/english/advisories/2006/2661
2006-07-06
Published