Description
The WYSIWYG component (wysiwyg.py) in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote attackers to obtain sensitive information via a crafted URL, which reveals the installation path in an error message.
Remediation
References
Related Vulnerabilities
WordPress Plugin Google Analytics by BestWebSoft Cross-Site Scripting (1.7.0)
Jenkins Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2014-3680)
PostgreSQL Other Vulnerability (CVE-2009-4136)
WordPress Plugin Apptivo Business Site CRM Multiple Cross-Site Scripting Vulnerabilities (1.2.9)
Jboss EAP Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-3370)