CVE-2013-2203

Name	CVE-2013-2203
Description	WordPress before 3.5.2, when the uploads directory forbids write access, allows remote attackers to obtain sensitive information via an invalid upload request, which reveals the absolute path in an XMLHttpRequest error message.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-2718-1
Debian Bugs	713947

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
wordpress (PTS)	bullseye (security), bullseye	5.7.11+dfsg1-0+deb11u1	fixed
	bookworm, bookworm (security)	6.1.6+dfsg1-0+deb12u1	fixed
	sid, trixie	6.6.1+dfsg1-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
wordpress	source	squeeze	3.5.2+dfsg-1~deb6u1		DSA-2718-1
wordpress	source	wheezy	3.5.2+dfsg-1~deb7u1		DSA-2718-1
wordpress	source	(unstable)	3.5.2+dfsg-1			713947