Description
Information disclosure issue in qdPM 8.3 allows remote attackers to obtain sensitive information via a direct request to (1) core/config/databases.yml, (2) core/log/qdPM_prod.log, or (3) core/apps/qdPM/config/settings.yml.
Remediation
References
Related Vulnerabilities
Moodle Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2016-5014)
Apache Tomcat CVE-2012-5568 Vulnerability (CVE-2012-5568)
MySQL Improper Validation of Array Index Vulnerability (CVE-2022-21310)
phpMyAdmin Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2008-5621)
Envoy Proxy Reachable Assertion Vulnerability (CVE-2021-29258)