CVE-2011-0701

Priority
Low
Description
wp-admin/async-upload.php in the media uploader in WordPress before 3.0.5
allows remote authenticated users to read (1) draft posts or (2) private
posts via a modified attachment_id parameter.
References
Package
Upstream:released (3.0.5)
Ubuntu 8.04 LTS (Hardy Heron):ignored (reached end-of-life)
Ubuntu 10.04 LTS (Lucid Lynx):needs-triage
Ubuntu 11.10 (Oneiric Ocelot):not-affected (3.0.5+dfsg-1ubuntu1)
Ubuntu 12.04 LTS (Precise Pangolin):not-affected (3.0.5+dfsg-1ubuntu1)
Ubuntu 12.10 (Quantal Quetzal):not-affected (3.0.5+dfsg-1ubuntu1)
Ubuntu 13.04 (Raring Ringtail):not-affected (3.0.5+dfsg-1ubuntu1)
More Information

Valid XHTML 1.0 Strict

Updated: 2013-04-25 17:14:25 UTC (commit 6757)