Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.0
CVE-2011-3796: PrestaShop 1.4.0.6 may expose server path to attackers
CVE-2011-3796 · published 15 years ago
Summary
The PrestaShop version 1.4.0.6 can reveal the location where it is installed when a specific PHP file is accessed. This information could help a remote attacker learn details about the system and plan further attacks. Update to a newer version or apply the vendor's patch to stop the error messages from disclosing the path.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| prestashop | prestashop |
1.4.0.6 cpe:2.3:a:prestashop:prestashop:1.4.0.6:*:*:*:*:*:*:* |
Original advisory text
PrestaShop 1.4.0.6 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by product-s...
PrestaShop 1.4.0.6 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by product-sort.php and certain other files.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Severity
5.0
Medium
Type
CWE-200Information Exposure
Timeline
Published24 Sep 2011
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2011-3796 · NVD
Track software like this
Free during beta