CVE-2011-3757: Infoleak
Published Sep 23, 2011
·Updated
Moodle 2.0.1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by webservice/xmlrpc/locallib.php and certain other files.
Affected Software
1 affected component
Moodle moodle=2.0.1
Event History
Sep 23, 2011
CVE Published
via MITRE·11:00 PM
Data Sourced
via MITRE·11:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2011-3757?
CVE-2011-3757 is classified as a moderate severity vulnerability.
2
How do I fix CVE-2011-3757?
To fix CVE-2011-3757, upgrade to a later version of Moodle that addresses this issue.
3
What type of information can an attacker gain from CVE-2011-3757?
An attacker can obtain the installation path of the Moodle application from error messages generated by specific PHP files.
4
Which version of Moodle is affected by CVE-2011-3757?
CVE-2011-3757 specifically affects Moodle version 2.0.1.
5
What is the nature of the vulnerability in CVE-2011-3757?
CVE-2011-3757 is a directory traversal vulnerability that allows unauthorized access to sensitive file information.