Description

b2evolution 3.3.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by locales/ru_RU/ru-RU.locale.php and certain other files.

Remediation

References

CVE-2011-3709

Related Vulnerabilities

WebLogic CVE-2017-10148 Vulnerability (CVE-2017-10148)

WordPress Plugin Better Search SQL Injection (2.2.2)

Vanilla Forums Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2011-3812)

MySQL CVE-2020-14680 Vulnerability (CVE-2020-14680)

Internet Information Services Permissions, Privileges, and Access Controls Vulnerability (CVE-1999-0777)

Severity

Medium

Classification

CVE-2011-3709 CWE-200

Tags

Missing Update Known Vulnerabilities