PT-2015-3510 · Redaxscript · Redaxscript
Published
2015-01-01
·
Updated
2015-01-02
·
CVE-2011-5314
CVSS v2.0
5.0
Medium
| Vector | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Redaxscript version 0.3.2
Description
The issue allows remote attackers to obtain sensitive information via a direct request to templates/default/index.php, which reveals the full path in an error message.
Recommendations
For Redaxscript version 0.3.2, consider restricting access to the templates/default/index.php file until a patch is available. As a temporary workaround, modify the error handling mechanism to prevent the disclosure of sensitive path information.
Exploit
Fix
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Redaxscript