Description

The request_path function in includes/bootstrap.inc in Drupal 7.14 and earlier allows remote attackers to obtain sensitive information via the q[] parameter to index.php, which reveals the installation path in an error message.

Remediation

References

CVE-2012-2922

Related Vulnerabilities

PHP Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-2335)

WordPress Plugin WP Fastest Cache Multiple Vulnerabilities (0.8.5.7)

Moodle Other Vulnerability (CVE-2006-0147)

Magento Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-7921)

ownCloud Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2012-4396)

Severity

Medium

Classification

CVE-2012-2922 CWE-200

Tags

Missing Update Known Vulnerabilities