CVE-2009-2432: Medium severity wordpress vulnerability
Published Jul 10, 2009
·Updated
WordPress and WordPress MU before 2.8.1 allow remote attackers to obtain sensitive information via a direct request to wp-settings.php, which reveals the installation path in an error message.
Affected Software
101 affected components
WordPress WordPress<=2.7.1
WordPress WordPress=0.6.2
WordPress WordPress=0.6.2-beta_2
WordPress WordPress=0.6.2.1
WordPress WordPress=0.6.2.1-beta_2
WordPress WordPress=0.7
WordPress WordPress=0.71
WordPress WordPress=0.71-gold
WordPress WordPress=0.72
WordPress WordPress=0.72-beta1
WordPress WordPress=0.72-beta2
WordPress WordPress=0.72-rc1
WordPress WordPress=0.711
WordPress WordPress=1.0
WordPress WordPress=1.0-rc1
WordPress WordPress=1.0-rc2
WordPress WordPress=1.0-rc3
WordPress WordPress=1.0-rc4
WordPress WordPress=1.0-platinum
WordPress WordPress=1.0.1
WordPress WordPress=1.0.1-miles
WordPress WordPress=1.0.2
WordPress WordPress=1.0.2-blakey
WordPress WordPress=1.2
WordPress WordPress=1.2-beta
WordPress WordPress=1.2-delta
WordPress WordPress=1.2-mingus
WordPress WordPress=1.2.1
WordPress WordPress=1.2.2
WordPress WordPress=1.3.1
WordPress WordPress=1.4
WordPress WordPress=1.5
WordPress WordPress=1.5-strayhorn
WordPress WordPress=1.5.1
WordPress WordPress=1.5.1.1
WordPress WordPress=1.5.1.2
WordPress WordPress=1.5.1.3
WordPress WordPress=1.5.2
WordPress WordPress=1.6
WordPress WordPress=2.0
WordPress WordPress=2.0.1
WordPress WordPress=2.0.2
WordPress WordPress=2.0.3
WordPress WordPress=2.0.4
WordPress WordPress=2.0.5
WordPress WordPress=2.0.6
WordPress WordPress=2.0.7
WordPress WordPress=2.0.8
WordPress WordPress=2.0.9
WordPress WordPress=2.0.10
WordPress WordPress=2.0.10_rc1
WordPress WordPress=2.0.10_rc2
WordPress WordPress=2.0.11
WordPress WordPress=2.1
WordPress WordPress=2.1-alpha_3
WordPress WordPress=2.1.1
WordPress WordPress=2.1.2
WordPress WordPress=2.1.3
WordPress WordPress=2.1.3_rc1
WordPress WordPress=2.1.3_rc2
WordPress WordPress=2.2
WordPress WordPress=2.2.0
WordPress WordPress=2.2.1
WordPress WordPress=2.2.2
WordPress WordPress=2.2.3
WordPress WordPress=2.2_revision5002
WordPress WordPress=2.2_revision5003
WordPress WordPress=2.3
WordPress WordPress=2.3-beta3
WordPress WordPress=2.3-rc1
WordPress WordPress=2.3.1
WordPress WordPress=2.3.1-rc1
WordPress WordPress=2.3.2
WordPress WordPress=2.3.3
WordPress WordPress=2.5
WordPress WordPress=2.5.1
WordPress WordPress=2.6
WordPress WordPress=2.6.1
WordPress WordPress=2.6.3
WordPress WordPress=2.6.5
WordPress Wordpress MU<=2.7
WordPress Wordpress MU=1.1
WordPress Wordpress MU=1.1.1
WordPress Wordpress MU=1.2
WordPress Wordpress MU=1.2.1
WordPress Wordpress MU=1.2.2
WordPress Wordpress MU=1.2.3
WordPress Wordpress MU=1.2.4
WordPress Wordpress MU=1.2.4-rc1
WordPress Wordpress MU=1.2.5a
WordPress Wordpress MU=1.3
WordPress Wordpress MU=1.3.1
WordPress Wordpress MU=1.3.2
WordPress Wordpress MU=1.3.3
WordPress Wordpress MU=1.5-rc1
WordPress Wordpress MU=1.5.1
WordPress Wordpress MU=2.6
WordPress Wordpress MU=2.6.1
WordPress Wordpress MU=2.6.2
WordPress Wordpress MU=2.6.3
WordPress Wordpress MU=2.6.5
Remediation
Patch Available
Patch Available
Event History
Jul 10, 2009
CVE Published
via MITRE·08:25 PM
Data Sourced
via MITRE·08:25 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2009-2432?
CVE-2009-2432 is classified as a vulnerability that allows remote attackers to obtain sensitive information.
2
How do I fix CVE-2009-2432?
To fix CVE-2009-2432, update WordPress to version 2.8.1 or later.
3
Which versions are affected by CVE-2009-2432?
CVE-2009-2432 affects WordPress versions prior to 2.8.1 and certain versions of WordPress MU.
4
What type of vulnerability is CVE-2009-2432?
CVE-2009-2432 is an information disclosure vulnerability.
5
Can CVE-2009-2432 be exploited without user interaction?
Yes, CVE-2009-2432 can be exploited remotely without requiring user interaction.