Description

CubeCart 4.4.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by modules/shipping/USPS/calc.php and certain other files.

Remediation

References

CVE-2011-3724

Related Vulnerabilities

Moodle Improper Authentication Vulnerability (CVE-2018-1082)

Envoy Proxy Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2023-27492)

WordPress Plugin Slideshow Gallery LITE Multiple Vulnerabilities (1.6.8)

WordPress Plugin 3D Product configurator for WooCommerce Arbitrary File Upload (1.5.531)

WordPress Plugin Thrive Architect Security Bypass (2.6.7.3)

Severity

Medium

Classification

CVE-2011-3724 CWE-200

Tags

Missing Update Known Vulnerabilities