Vulnerability Description
(1) wp-dbmanager.php and (2) database-manage.php in the WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress place credentials on the mysqldump command line, which allows local users to obtain sensitive information by listing the process.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Wp-Dbmanager Project | Wp-Dbmanager | <= 2.7.1 |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/128785/WordPress-Database-Manager-2.7.1-ComExploitIssue TrackingThird Party Advisory
- http://www.openwall.com/lists/oss-security/2014/10/20/7Mailing List
- http://www.vapid.dhs.org/advisories/wordpress/plugins/wp-dbmanager-2.7.1/index.hExploitThird Party Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/97691VDB Entry
- https://github.com/lesterchan/wp-dbmanager/commit/7037fa8f61644098044379190d1d4bIssue TrackingPatchThird Party Advisory
- https://wordpress.org/plugins/wp-dbmanager/#developersThird Party Advisory
- http://packetstormsecurity.com/files/128785/WordPress-Database-Manager-2.7.1-ComExploitIssue TrackingThird Party Advisory
- http://www.openwall.com/lists/oss-security/2014/10/20/7Mailing List
- http://www.vapid.dhs.org/advisories/wordpress/plugins/wp-dbmanager-2.7.1/index.hExploitThird Party Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/97691VDB Entry
- https://github.com/lesterchan/wp-dbmanager/commit/7037fa8f61644098044379190d1d4bIssue TrackingPatchThird Party Advisory
- https://wordpress.org/plugins/wp-dbmanager/#developersThird Party Advisory
FAQ
What is CVE-2014-8335?
CVE-2014-8335 is a vulnerability with a CVSS score of 7.8 (HIGH). (1) wp-dbmanager.php and (2) database-manage.php in the WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress place credentials on the mysqldump command line, which allows local users ...
How severe is CVE-2014-8335?
CVE-2014-8335 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2014-8335?
Check the references section above for vendor advisories and patch information. Affected products include: Wp-Dbmanager Project Wp-Dbmanager.