Bug 198107 (CVE-2006-3390)

Summary: CVE-2006-3390: Wordpress information disclosure
Product: [Fedora] Fedora Reporter: Ville Skyttä <scop>
Component: wordpressAssignee: John Berninger <john>
Status: CLOSED NOTABUG QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: medium    
Version: 5CC: extras-qa, fedora-security-list
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
URL: http://nvd.nist.gov/nvd.cfm?cvename=CVE-2006-3390
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2006-07-20 12:14:20 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Description Ville Skyttä 2006-07-09 18:54:57 UTC
WordPress 2.0.3 allows remote attackers to obtain the installation path via a
direct request to various files, such as those in the (1) wp-admin, (2)
wp-content, and (3) wp-includes directories, possibly due to uninitialized
variables.

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2006-3390

This sounds to me like a "not an issue, installation paths are not a secret in
Fedora", but a confirmation from someone familiar with Wordpress would be nice.

Comment 1 John Berninger 2006-07-09 19:13:30 UTC
Not only are installation paths not secret, but there dosn't seem to be any true
information leak:
http://www.securityfocus.com/archive/1/439031/100/0/threaded

If there are no objections within a few days to a week, I'll close this NOTBUG
at that time.