Description
Elgg 1.7.6 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by vendors/simpletest/test/visual_test.php and certain other files.
Remediation
References
Related Vulnerabilities
MySQL CVE-2018-3145 Vulnerability (CVE-2018-3145)
Apache HTTP Server Numeric Errors Vulnerability (CVE-2003-1580)
Atlassian Jira Server-Side Request Forgery (SSRF) Vulnerability (CVE-2019-8451)
WordPress Plugin Dropdown Menu Widget Cross-Site Request Forgery (1.9.1)
Apache HTTP Server Uncontrolled Resource Consumption Vulnerability (CVE-2018-1333)