CVE-2011-3707: Infoleak
JanRain PHP OpenID library (aka php-openid) 2.2.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by Auth/Yadis/Yadis.php and certain other files.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2011-3707?
CVE-2011-3707 is considered a medium severity vulnerability that can result in sensitive information disclosure.
How do I fix CVE-2011-3707?
To fix CVE-2011-3707, upgrade the JanRain PHP OpenID library to a version that does not expose sensitive information through error messages.
What types of attacks can occur due to CVE-2011-3707?
CVE-2011-3707 can be exploited by remote attackers to disclose sensitive installation path information.
Which version of JanRain PHP OpenID is affected by CVE-2011-3707?
Only JanRain PHP OpenID version 2.2.2 is affected by CVE-2011-3707.
Is there any sensitive information exposed in CVE-2011-3707?
Yes, CVE-2011-3707 can expose the installation path in error messages.