Description
b2evolution 3.3.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by locales/ru_RU/ru-RU.locale.php and certain other files.
Remediation
References
Related Vulnerabilities
Oracle JRE CVE-2013-5783 Vulnerability (CVE-2013-5783)
Drupal Permissions, Privileges, and Access Controls Vulnerability (CVE-2010-3092)
Django Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2014-0472)
WordPress Plugin Skype Legacy Buttons Multiple Vulnerabilities (3.0.4)
IBM RTC Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2017-1559)