Description

SugarCRM 6.1.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by themes/Sugar5/layout_utils.php and certain other files.

Remediation

References

CVE-2011-3803

Related Vulnerabilities

Jenkins Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2019-10352)

Moodle Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-4408)

Internet Information Services Other Vulnerability (CVE-2002-1695)

Serendipity Other Vulnerability (CVE-2015-6968)

Apache Tomcat Other Vulnerability (CVE-2002-2009)

Severity

Medium

Classification

CVE-2011-3803 CWE-200

Tags

Missing Update Known Vulnerabilities