bugtraq - Re: Wordpress Malicious File Execution Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 23 Jul 2008 19:44:51 -0000
From: otto@...odestruct.com
To: bugtraq@...urityfocus.com
Subject: Re: Wordpress Malicious File Execution Vulnerability

Regarding this report of May 2008:
http://www.securityfocus.com/bid/29276
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2392

The report is invalid. This is not a vulnerability or a security flaw. Quite frankly, I think it's a joke.

The report itself states: "You must login into wordpress with Administrator Roles". If you have logged into WordPress with Admin roles, then you are the blog owner or administrator. The fact that you can then upload any sort of file you want is a feature, not a bug. The admin has unlimited rights to the site, because he is the admin. Obviously.

Suggest this be marked as invalid everywhere it's been incorrectly marked as valid.