Unscored CVE-2011-3825 EUVD-2011-3782GHSA-fhjm-rh64-w3x4

Zend Framework 1.11.3 in Zend Server CE 5.1.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, …

Published Sep 24, 2011 · Updated Sep 17, 2024 · Assigned by mitre

Package: zend-framework Ecosystem: Ubuntu

Description

Zend Framework 1.11.3 in Zend Server CE 5.1.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by Validate.php and certain other files.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 16.04 LTS	zend-framework	No fix yet	—

References

http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/Zend
[oss-security] 20110627 Re: CVE request: Joomla unspecified information disclosure vulnerability mailing-list
http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README