CVE-2015-3881
HighSummary
A vulnerability in qdPM 8.3 allows remote attackers to obtain sensitive information via a direct request to specific configuration and log files.
Risk Assessment
Organizations may be exposed to the disclosure of sensitive data, potentially leading to further attacks or privacy breaches.
Recommendation
It is recommended to secure access to the mentioned files and monitor logs for unauthorized access attempts.
Other vulnerabilities in qdPM 8.3
See all- CVE-2015-3884High
qdPM 8.3 has an unrestricted file upload vulnerability that allows remote attackers to execute arbitrary code by uploading a file with an executable extension.
- CVE-2019-25669High
qdPM 9.1 is vulnerable to SQL injection via the search_by_extrafields[] parameter. An attacker can manipulate database queries by sending crafted POST requests to the users endpoint, leading to data exfiltration.
Original NVD description (English source)
Information disclosure issue in qdPM 8.3 allows remote attackers to obtain sensitive information via a direct request to (1) core/config/databases.yml, (2) core/log/qdPM_prod.log, or (3) core/apps/qdPM/config/settings.yml.