CVE-2011-3709: Infoleak
Published Sep 23, 2011
·Updated
b2evolution 3.3.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by locales/ruRU/ru-RU.locale.php and certain other files.
Affected Software
1 affected component
b2evolution b2evolution=3.3.3
Event History
Sep 23, 2011
CVE Published
via MITRE·11:00 PM
Data Sourced
via MITRE·11:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2011-3709?
CVE-2011-3709 has a moderate severity rating due to potential information disclosure.
2
How do I fix CVE-2011-3709?
To fix CVE-2011-3709, restrict direct access to sensitive .php files or apply the latest security updates for b2evolution.
3
What information can attackers gain from CVE-2011-3709?
Attackers can gain sensitive information including the installation path of the b2evolution application due to error messages.
4
Which version of b2evolution is affected by CVE-2011-3709?
CVE-2011-3709 affects b2evolution version 3.3.3.
5
Is CVE-2011-3709 still relevant today?
Yes, CVE-2011-3709 remains relevant for those using the vulnerable version of b2evolution without patches.