CVE-2011-3706: Infoleak
Published Sep 23, 2011
·Updated
ATutor 2.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by users/toolsettings.inc.php and certain other files.
Affected Software
1 affected component
ATutor ATutor=2.0
Event History
Sep 23, 2011
CVE Published
via MITRE·11:00 PM
Data Sourced
via MITRE·11:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2011-3706?
CVE-2011-3706 has been rated as having a medium severity due to potential sensitive information disclosure.
2
How can CVE-2011-3706 be mitigated?
To mitigate CVE-2011-3706, ensure that direct access to sensitive PHP files is restricted or protected.
3
What type of information can be exposed by CVE-2011-3706?
CVE-2011-3706 can expose sensitive information such as the installation path through error messages.
4
Which versions of ATutor are affected by CVE-2011-3706?
CVE-2011-3706 affects ATutor version 2.0.
5
What actions should be taken if CVE-2011-3706 is found in my system?
If CVE-2011-3706 is found, it is recommended to update the software or apply appropriate access controls immediately.