Description

TYPO3 3.7.1 allows remote attackers to obtain sensitive information via a direct request to (1) thumbs.php, (2) showpic.php, or (3) tables.php, which causes them to incorrectly define a variable and reveal the path in an error message when a require function call fails.

Remediation

References

CVE-2006-0327

Related Vulnerabilities

WordPress Plugin HUSKY-Products Filter Professional for WooCommerce Multiple Vulnerabilities (1.1.4.2)

WordPress Plugin Tracking Code Manager Multiple Vulnerabilities (1.11.1)

WordPress Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2008-0194)

Drupal Core 8.9.x Arbitrary File Overwrite (8.9.0 - 8.9.12)

WordPress Plugin Shoppable Images Multiple Vulnerabilities (1.0.0)

Severity

Medium

Classification

CVE-2006-0327

Tags

Missing Update Known Vulnerabilities