CVE-2011-3752: Infoleak

Published Sep 23, 2011

Updated

LimeSurvey 1.90+ build9642-20101214 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by admin/statistics.php and certain other files.

Affected Software

1 affected component

Limesurvey LimeSurvey=1.90\+

Event History

Sep 23, 2011

CVE Published

via MITRE·11:00 PM

Data Sourced

via MITRE·11:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2011-3752?

CVE-2011-3752 is considered a moderate severity vulnerability due to the potential exposure of sensitive information.

How do I fix CVE-2011-3752?

To fix CVE-2011-3752, upgrade to a patched version of LimeSurvey that addresses this vulnerability.

What type of attack is CVE-2011-3752 vulnerable to?

CVE-2011-3752 is vulnerable to information disclosure attacks that can reveal the installation path of the LimeSurvey application.

Which versions of LimeSurvey are affected by CVE-2011-3752?

CVE-2011-3752 affects LimeSurvey versions 1.90+ up to build 9642-20101214.

Can CVE-2011-3752 be exploited remotely?

Yes, CVE-2011-3752 can be exploited remotely by sending direct requests to certain .php files.