Description

ATutor 2.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by users/tool_settings.inc.php and certain other files.

Remediation

References

CVE-2011-3706

Related Vulnerabilities

Joomla! Core 3.x.x Multiple Vulnerabilities (3.7.0 - 3.8.3)

TYPO3 Improper Input Validation Vulnerability (CVE-2011-4904)

Oracle Application Server CVE-2007-5520 Vulnerability (CVE-2007-5520)

MediaWiki Incorrect Permission Assignment for Critical Resource Vulnerability (CVE-2021-30156)

Magento CVE-2019-8111 Vulnerability (CVE-2019-8111)

Severity

Medium

Classification

CVE-2011-3706 CWE-200

Tags

Missing Update Known Vulnerabilities