CVE-2006-2702 - Vulnerability Details - OpenCVE

vars.php in WordPress 2.0.2, possibly when running on Mac OS X, allows remote attackers to spoof their IP address via a PC_REMOTE_ADDR HTTP header, which vars.php uses to redefine $_SERVER['REMOTE_ADDR'].

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Wordpress	Wordpress

Configuration 1 [-]

cpe:2.3:a:wordpress:wordpress:2.0.2:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://retrogod.altervista.org/wordpress_202_xpl.html
http://secunia.com/advisories/20271
http://secunia.com/advisories/20608
http://www.gentoo.org/security/en/glsa/glsa-200606-08.xml
http://www.osvdb.org/25935
http://www.securityfocus.com/archive/1/435039/100/0/threaded
http://www.vupen.com/english/advisories/2006/1992
https://exchange.xforce.ibmcloud.com/vulnerabilities/26688

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2006-05-31T10:00:00

Updated: 2024-08-07T17:58:51.909Z

Reserved: 2006-05-30T00:00:00

Link: CVE-2006-2702

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2006-05-31T10:06:00.000

Modified: 2025-04-03T01:03:51.193

Link: CVE-2006-2702

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2006-05-25T00:00:00", "descriptions": [{"lang": "en", "value": "vars.php in WordPress 2.0.2, possibly when running on Mac OS X, allows remote attackers to spoof their IP address via a PC_REMOTE_ADDR HTTP header, which vars.php uses to redefine $_SERVER['REMOTE_ADDR']."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-18T14:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "20271", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/20271"}, {"name": "ADV-2006-1992", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2006/1992"}, {"name": "25935", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://www.osvdb.org/25935"}, {"name": "wordpress-pcremoteaddr-ip-spoofing(26688)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26688"}, {"name": "20608", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/20608"}, {"name": "GLSA-200606-08", "tags": ["vendor-advisory", "x_refsource_GENTOO"], "url": "http://www.gentoo.org/security/en/glsa/glsa-200606-08.xml"}, {"tags": ["x_refsource_MISC"], "url": "http://retrogod.altervista.org/wordpress_202_xpl.html"}, {"name": "20060525 Wordpress <=2.0.2 'cache' shell injection", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/435039/100/0/threaded"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2006-2702", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "vars.php in WordPress 2.0.2, possibly when running on Mac OS X, allows remote attackers to spoof their IP address via a PC_REMOTE_ADDR HTTP header, which vars.php uses to redefine $_SERVER['REMOTE_ADDR']."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "20271", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/20271"}, {"name": "ADV-2006-1992", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2006/1992"}, {"name": "25935", "refsource": "OSVDB", "url": "http://www.osvdb.org/25935"}, {"name": "wordpress-pcremoteaddr-ip-spoofing(26688)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26688"}, {"name": "20608", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/20608"}, {"name": "GLSA-200606-08", "refsource": "GENTOO", "url": "http://www.gentoo.org/security/en/glsa/glsa-200606-08.xml"}, {"name": "http://retrogod.altervista.org/wordpress_202_xpl.html", "refsource": "MISC", "url": "http://retrogod.altervista.org/wordpress_202_xpl.html"}, {"name": "20060525 Wordpress <=2.0.2 'cache' shell injection", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/435039/100/0/threaded"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T17:58:51.909Z"}, "title": "CVE Program Container", "references": [{"name": "20271", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/20271"}, {"name": "ADV-2006-1992", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2006/1992"}, {"name": "25935", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://www.osvdb.org/25935"}, {"name": "wordpress-pcremoteaddr-ip-spoofing(26688)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26688"}, {"name": "20608", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/20608"}, {"name": "GLSA-200606-08", "tags": ["vendor-advisory", "x_refsource_GENTOO", "x_transferred"], "url": "http://www.gentoo.org/security/en/glsa/glsa-200606-08.xml"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://retrogod.altervista.org/wordpress_202_xpl.html"}, {"name": "20060525 Wordpress <=2.0.2 'cache' shell injection", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/435039/100/0/threaded"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2006-2702", "datePublished": "2006-05-31T10:00:00", "dateReserved": "2006-05-30T00:00:00", "dateUpdated": "2024-08-07T17:58:51.909Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wordpress:wordpress:2.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "92F05A1F-2227-4166-807B-1BDE2EA8F245", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "vars.php in WordPress 2.0.2, possibly when running on Mac OS X, allows remote attackers to spoof their IP address via a PC_REMOTE_ADDR HTTP header, which vars.php uses to redefine $_SERVER['REMOTE_ADDR']."}], "id": "CVE-2006-2702", "lastModified": "2025-04-03T01:03:51.193", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2006-05-31T10:06:00.000", "references": [{"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://retrogod.altervista.org/wordpress_202_xpl.html"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Vendor Advisory"], "url": "http://secunia.com/advisories/20271"}, {"source": "cve@mitre.org", "url": "http://secunia.com/advisories/20608"}, {"source": "cve@mitre.org", "url": "http://www.gentoo.org/security/en/glsa/glsa-200606-08.xml"}, {"source": "cve@mitre.org", "url": "http://www.osvdb.org/25935"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/435039/100/0/threaded"}, {"source": "cve@mitre.org", "url": "http://www.vupen.com/english/advisories/2006/1992"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26688"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://retrogod.altervista.org/wordpress_202_xpl.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Vendor Advisory"], "url": "http://secunia.com/advisories/20271"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/20608"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.gentoo.org/security/en/glsa/glsa-200606-08.xml"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.osvdb.org/25935"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/435039/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.vupen.com/english/advisories/2006/1992"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26688"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}