Description (CNA)
Vvveb before version 1.0.8.2 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain sensitive server information by triggering unhandled exceptions in the password-reset module. Attackers can access the admin password-reset endpoint to trigger a fatal error caused by a missing namespace import, which exposes the absolute server file path, internal class namespaces, line numbers, and source code excerpts through the debug exception handler rendered to unauthenticated requests.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| givanz / Vvveb | affected 0 before 1.0.8.2 |
CWE
CWE-1188, CWE-209
References
- https://github.com/givanz/Vvveb/releases/tag/1.0.8.2
- https://github.com/givanz/Vvveb/security/advisories/GHSA-xgvg-r47g-786r
- https://www.vulncheck.com/advisories/vvveb-information-disclosure-via-debug-exception-handler
ADP enrichment
No English description supplied.