Bug 198107 (CVE-2006-3390)

Summary:	CVE-2006-3390: Wordpress information disclosure
Product:	[Fedora] Fedora	Reporter:	Ville Skyttä <scop>
Component:	wordpress	Assignee:	John Berninger <john>
Status:	CLOSED NOTABUG	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	5	CC:	extras-qa, fedora-security-list
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
URL:	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2006-3390
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2006-07-20 12:14:20 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Ville Skyttä 2006-07-09 18:54:57 UTC

WordPress 2.0.3 allows remote attackers to obtain the installation path via a
direct request to various files, such as those in the (1) wp-admin, (2)
wp-content, and (3) wp-includes directories, possibly due to uninitialized
variables.

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2006-3390

This sounds to me like a "not an issue, installation paths are not a secret in
Fedora", but a confirmation from someone familiar with Wordpress would be nice.

Comment 1 John Berninger 2006-07-09 19:13:30 UTC

Not only are installation paths not secret, but there dosn't seem to be any true
information leak:
http://www.securityfocus.com/archive/1/439031/100/0/threaded

If there are no objections within a few days to a week, I'll close this NOTBUG
at that time.