CVE-2012-2922

Summary

The request_path function in includes/bootstrap.inc in Drupal 7.14 and earlier allows remote attackers to obtain sensitive information via the q[] parameter to index.php, which reveals the installation path in an error message.

Affected Software

Weaknesses

• n/a

ADP Enrichment

CVE Program Container

Additional References

• http://osvdb.org/81817
• https://exchange.xforce.ibmcloud.com/vulnerabilities/75531
• http://archives.neohapsis.com/archives/bugtraq/2012-05/0053.html
• http://www.mandriva.com/security/advisories?name=MDVSA-2013:074
• http://secunia.com/advisories/49131
• http://www.securityfocus.com/bid/53454
• http://archives.neohapsis.com/archives/bugtraq/2012-05/0052.html
• http://archives.neohapsis.com/archives/bugtraq/2012-05/0055.html
• http://www.openwall.com/lists/oss-security/2012/08/02/8

References

• http://osvdb.org/81817
• https://exchange.xforce.ibmcloud.com/vulnerabilities/75531
• http://archives.neohapsis.com/archives/bugtraq/2012-05/0053.html
• http://www.mandriva.com/security/advisories?name=MDVSA-2013:074
• http://secunia.com/advisories/49131
• http://www.securityfocus.com/bid/53454
• http://archives.neohapsis.com/archives/bugtraq/2012-05/0052.html
• http://archives.neohapsis.com/archives/bugtraq/2012-05/0055.html
• http://www.openwall.com/lists/oss-security/2012/08/02/8

• ←Previous
• Next→