XenForo before 2.3.7 discloses filesystem paths through exception messages triggered by open_basedir restrictions. This allows an attacker to obtain information about the server's directory structure.
| Vendor | Product | Versions |
|---|---|---|
| xenforo | xenforo | 2.3.0 |
Updated affected versions to 2.3.6, changed severity to HIGH, and noted that the exploit is not available but the vulnerability is actively exploited.
Initial creation
