Description
WordPress before 3.5.2, when the uploads directory forbids write access, allows remote attackers to obtain sensitive information via an invalid upload request, which reveals the absolute path in an XMLHttpRequest error message.
Remediation
References
Related Vulnerabilities
MediaWiki Insertion of Sensitive Information into Log File Vulnerability (CVE-2018-0504)
osCommerce Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2018-18572)
Jenkins Improper Input Validation Vulnerability (CVE-2013-0331)
WebLogic CVE-2021-1995 Vulnerability (CVE-2021-1995)
Joomla Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2013-1455)