CVE-2012-3996: Infoleak
Published Jul 12, 2012
·Updated
TikiWiki CMS/Groupware 8.3 and earlier allows remote attackers to obtain the installation path via a direct request to (1) admin/includecalendar.php, (2) tiki-rsserror.php, or (3) tiki-watershedservice.php.
Affected Software
24 affected components
Tiki Wiki CMS Groupware<=8.2
Tiki Wiki CMS Groupware=2.2
Tiki Wiki CMS Groupware=3.0
Tiki Wiki CMS Groupware=3.1
Tiki Wiki CMS Groupware=3.2
Tiki Wiki CMS Groupware=3.3
Tiki Wiki CMS Groupware=3.4
Tiki Wiki CMS Groupware=3.5
Tiki Wiki CMS Groupware=4
Tiki Wiki CMS Groupware=4.0
Tiki Wiki CMS Groupware=4.1
Tiki Wiki CMS Groupware=4.2
Tiki Wiki CMS Groupware=5.0
Tiki Wiki CMS Groupware=5.1
Tiki Wiki CMS Groupware=5.2
Tiki Wiki CMS Groupware=5.3
Tiki Wiki CMS Groupware=6.0
Tiki Wiki CMS Groupware=6.1
Tiki Wiki CMS Groupware=6.2
Tiki Wiki CMS Groupware=7.0
Tiki Wiki CMS Groupware=7.1
Tiki Wiki CMS Groupware=7.2
Tiki Wiki CMS Groupware=8.0
Tiki Wiki CMS Groupware=8.1
Remediation
Patch Available
Patch Available
Event History
Jul 12, 2012
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2012-3996?
CVE-2012-3996 is considered a moderate severity vulnerability as it allows remote attackers to disclose sensitive information.
2
How do I fix CVE-2012-3996?
To mitigate CVE-2012-3996, upgrade to TikiWiki CMS/Groupware version 8.4 or later.
3
What are the affected versions of TikiWiki CMS/Groupware for CVE-2012-3996?
Affected versions include TikiWiki CMS/Groupware 8.3 and earlier.
4
What type of vulnerability is CVE-2012-3996?
CVE-2012-3996 is a path disclosure vulnerability that allows attackers to obtain installation paths.
5
Can CVE-2012-3996 be exploited remotely?
Yes, CVE-2012-3996 can be exploited remotely through direct requests to vulnerable scripts.