CVE-2006-0327 Information disclosure in n/a
Remote attackers can obtain sensitive path information via direct requests to specific PHP scripts due to improper error handling.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2006-0327?
CVE-2006-0327 is a medium-severity vulnerability in Typo3 Typo3, published on 21 Jan 2006. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
TYPO3 3.7.1 allows remote attackers to obtain sensitive information via a direct request to (1) thumbs.php, (2) showpic.php, or (3) tables.php, which causes them to incorrectly define a variable and reveal the path in an error message when a require function call fails.
Which versions are affected by CVE-2006-0327?
It affects 1 product.
Products include Typo3 Typo3.
How do I fix CVE-2006-0327?
No fix has been published for CVE-2006-0327 yet. Limit exposure of the affected software until one is available.
Is CVE-2006-0327 being exploited?
There is no known exploitation of CVE-2006-0327 in the wild and no public exploit code.
Other vulnerabilities in Typo3 Typo3
- CVE-2009-0258 Indexed Search Engine for TYPO3 Command Execution via Metacharacter Injection
- CVE-2011-3583 Typo3 SQL injection due to faulty prepared statements
- CVE-2011-4628 Typo3 Authentication Bypass
- CVE-2023-24814 Persisted Cross-Site Scripting in Frontend Rendering in typo3
- CVE-2021-41113 Cross-Site-Request-Forgery in Backend URI Handling in Typo3
Sources
Also known as GHSA-pc69-wrpv-h7r8.