CVE-2014-8082 lib/functions/database.class.php in TestLink before 1.9.13 allows remote attackers to obtain sensitive information via unspecified vectors, which reveals the installation path in an error message.
MediumCVSS 5.0
EPSS 2.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
lib/functions/database.class.php in TestLink before 1.9.13 allows remote attackers to obtain sensitive information via unspecified vectors, which reveals the installation path in an error message.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| testlink | <= 1.9.12 | No fix listed |
References
- karmainsecurity.com exploit patch
- mantis.testlink.org vendor-advisory
- packetstormsecurity.com exploit patch
- 20141023 [KIS-2014-12] TestLink <= 1.9.12 (database.class.php) Path Disclosure Weakness exploit mailing-list patch
- 20141023 [KIS-2014-12] TestLink <= 1.9.12 (database.class.php) Path Disclosure Weakness mailing-list
- 70713 vdb-entry
- testlink-cve20148082-path-disclosure(97728) vdb-entry
- gitorious.org