HTML Purifier allows remote attackers to obtain sensitive information
Date: 2022-05
Affected: composer/ezyang/htmlpurifier
Attack vector: info-disclosure
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2011-3744
CWE: CWE-200
CVSS: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

HTML Purifier 4.2.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by tests/PHPT/Reporter/SimpleTest.php and certain other files.


Mitigations:

Architectural layers (MAESTRO):