The file upload functionality in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2, when running on hosts with dangerous security settings, has unknown impact and attack vectors, possibly related to dangerous filenames.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Wordpress | Wordpress | 3.1 (including) | 3.1 (including) |
| Wordpress | Wordpress | 3.1.1 (including) | 3.1.1 (including) |
| Wordpress | Wordpress | 3.1.2 (including) | 3.1.2 (including) |
| Wordpress | Wordpress | 3.2-beta1 (including) | 3.2-beta1 (including) |
| Wordpress | Ubuntu | hardy | * |
| Wordpress | Ubuntu | lucid | * |
| Wordpress | Ubuntu | maverick | * |
| Wordpress | Ubuntu | natty | * |
| Wordpress | Ubuntu | oneiric | * |
| Wordpress | Ubuntu | upstream | * |
References
- http://secunia.com/advisories/49138
- http://wordpress.org/news/2011/05/wordpress-3-1-3/
- http://www.debian.org/security/2012/dsa-2470
- http://www.securityfocus.com/bid/47995
- http://secunia.com/advisories/49138
- http://wordpress.org/news/2011/05/wordpress-3-1-3/
- http://www.debian.org/security/2012/dsa-2470
- http://www.securityfocus.com/bid/47995