CVE-2011-3757

Name of the Vulnerable Software and Affected Versions Moodle version 2.0.1

Description The issue allows remote attackers to obtain sensitive information via a direct request to a .php file. This is achieved by revealing the installation path in an error message. For example, requesting webservice/xmlrpc/locallib.php and certain other files can expose this information.

Recommendations For Moodle version 2.0.1, consider restricting access to sensitive .php files, such as webservice/xmlrpc/locallib.php, to prevent information disclosure until a fix is available.