CVE-2006-6017

CVSS 6.5 MEDIUMEPSS 2.3%CWE-400

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 6.5EPSS 2.3%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Lifecycle

21 Nov 2006Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

WordPress before 2.0.5 does not properly store a profile containing a string representation of a serialized object, which allows remote authenticated users to cause a denial of service (application crash) via a string that represents a (1) malformed or (2) large serialized object, because the object triggers automatic unserialization for display.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

n/a · n/a

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://bugs.gentoo.org/show_bug.cgi?id=153303 http://trac.wordpress.org/ticket/2591 http://www.gentoo.org/security/en/glsa/glsa-200611-10.xml