Description

ATutor 2.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by users/tool_settings.inc.php and certain other files.

Remediation

References

CVE-2011-3706

Related Vulnerabilities

WordPress Plugin WP Accurate Form Data Multiple Vulnerabilities (1.2)

WordPress 4.1.x Directory Traversal (4.1 - 4.1.40)

WordPress Plugin Catchers Helpdesk and Ticket system for Support Cross-Site Scripting (1.0.3)

Grafana Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-12052)

PHP Out-of-bounds Write Vulnerability (CVE-2017-9228)

Severity

Medium

Classification

CVE-2011-3706 CWE-200

Tags

Missing Update Known Vulnerabilities