Description

The request_path function in includes/bootstrap.inc in Drupal 7.14 and earlier allows remote attackers to obtain sensitive information via the q[] parameter to index.php, which reveals the installation path in an error message.

Remediation

References

CVE-2012-2922

Related Vulnerabilities

Atlassian Confluence CVE-2023-22515 Vulnerability (CVE-2023-22515)

Python Improper Input Validation Vulnerability (CVE-2020-8315)

WordPress 5.1.x Multiple Vulnerabilities (5.1 - 5.1.2)

WordPress Plugin The Plus Addons for Elementor Security Bypass (4.1.6)

WordPress Plugin Cookiebot-GDPR/CCPA Compliant Cookie Consent and Control Cross-Site Scripting (3.6.0)

Severity

Medium

Classification

CVE-2012-2922 CWE-200

Tags

Missing Update Known Vulnerabilities