CVE-2014-8335

(1) wp-dbmanager.php and (2) database-manage.php in the WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress place credentials on the mysqldump command line, which allows local users to obtain sensitive information by listing the process.

Score

CVSS 3.0 7.8 High

Status

Modified - cve@mitre.org

Published

2018-01-05

Last modified

2024-08-06

Weaknesses

CWE-255

Affected products

• Wp-dbmanager (Wp-dbmanager Project)

References

• http://packetstormsecurity.com/files/128785/WordPress-Database-Manager-2.7.1-Command-Injection-Credential-Leak.html
• http://www.openwall.com/lists/oss-security/2014/10/20/7
• http://www.vapid.dhs.org/advisories/wordpress/plugins/wp-dbmanager-2.7.1/index.html
• https://exchange.xforce.ibmcloud.com/vulnerabilities/97691
• https://github.com/lesterchan/wp-dbmanager/commit/7037fa8f61644098044379190d1d4bf1883b8e4a
• https://wordpress.org/plugins/wp-dbmanager/#developers