CVE-2011-3789: Infoleak
Published Sep 24, 2011
·Updated
phpwcms 1.4.7 r412 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by template/incscript/frontendrender/disabled/majonavi.php and certain other files.
Affected Software
1 affected component
Phpwcms Phpwcms=1.4.7-r412
Event History
Sep 24, 2011
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2011-3789?
CVE-2011-3789 is classified as a moderate severity vulnerability.
2
How do I fix CVE-2011-3789?
To fix CVE-2011-3789, upgrade phpwcms to a version that does not expose file paths through error messages.
3
What kind of information can be exposed due to CVE-2011-3789?
CVE-2011-3789 can expose sensitive information including the installation path of the phpwcms application.
4
What versions of phpwcms are affected by CVE-2011-3789?
CVE-2011-3789 affects phpwcms version 1.4.7 r412.
5
Is there a public exploit for CVE-2011-3789 available?
Yes, CVE-2011-3789 has been publicly documented and can be exploited via direct requests to vulnerable PHP scripts.