Description

Hesk 2.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by inc/footer.inc.php and certain other files.

Remediation

References

CVE-2011-3743

Related Vulnerabilities

WordPress Plugin Nifty Newsletters (Formerly Sola Newsletters) Cross-Site Request Forgery (4.0.23)

Oracle Application Server Other Vulnerability (CVE-2006-3710)

WordPress Plugin WordPress Mobile Pack Information Disclosure (2.0.1)

Drupal Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2013-6388)

PHP Other Vulnerability (CVE-2011-0420)

Severity

Medium

Classification

CVE-2011-3743 CWE-200

Tags

Missing Update Known Vulnerabilities