Description

Moodle 1.6.5, when display_errors is enabled, allows remote attackers to obtain sensitive information via a direct request to (1) blog/blogpage.php and (2) course/report/stats/report.php, which reveals the installation path in an error message.

Remediation

References

CVE-2008-3327

Related Vulnerabilities

phpMyFAQ Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2017-7579)

b2evolution Improper Input Validation Vulnerability (CVE-2017-1000423)

WordPress Plugin WP Lead Management Cross-Site Scripting (3.0.0)

WordPress Plugin Comments-wpDiscuz Arbitrary File Upload (7.0.4)

WordPress 5.0.x Cross-Site Request Forgery (5.0 - 5.0.3)

Severity

Medium

Classification

CVE-2008-3327 CWE-200

Tags

Missing Update Known Vulnerabilities