CVE-2011-3825: Infoleak
Zend Framework 1.11.3 in Zend Server CE 5.1.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by Validate.php and certain other files.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2011-3825?
CVE-2011-3825 is classified as a moderate severity vulnerability due to the potential exposure of sensitive information.
How does CVE-2011-3825 impact Zend Framework 1.11.3?
CVE-2011-3825 allows remote attackers to gain access to sensitive information through error messages by making direct requests to certain .php files.
What versions of software are affected by CVE-2011-3825?
CVE-2011-3825 specifically affects Zend Framework version 1.11.3 and Zend Server version 5.1.0 CE.
How do I fix CVE-2011-3825?
To mitigate CVE-2011-3825, it is recommended to upgrade to a later version of Zend Framework or Zend Server that addresses this vulnerability.
Is there a way to prevent CVE-2011-3825 from being exploited?
Preventing exploitation of CVE-2011-3825 can involve implementing access controls and error handling that do not disclose sensitive paths in error messages.