CVE-2012-6515 eFront 3.6.10, 3.6.11 build 15059, and earlier allows remote attackers to obtain sensitive information via invalid courses_ID parameter in the lesson_info module to index.php, which reveals the instal...
MediumCVSS 5.0
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
eFront 3.6.10, 3.6.11 build 15059, and earlier allows remote attackers to obtain sensitive information via invalid courses_ID parameter in the lesson_info module to index.php, which reveals the installation path in an error message.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| efrontlearning efront | = 3.6.10 | No fix listed |
| efrontlearning efront | = 3.6.11 | No fix listed |
References
- hauntit.blogspot.com exploit
- 49003 third-party-advisory vendor-advisory
- 53272 vdb-entry