CVE-2011-2889

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2011-07-27 · updated 2026-06-16
Weakness: CWE-200

Description

templates/system/error.php in Joomla! before 1.5.23 might allow remote attackers to obtain sensitive information via unspecified vectors that trigger an undefined value of a certain error field, leading to disclosure of the installation path. NOTE: this might overlap CVE-2011-2488.

Affected products

Joomla!: through 1.5.22; 1.5.0, 1.5.1, 1.5.2, 1.5.3, 1.5.4, 1.5.5 (+17)

References

http://developer.joomla.org/security/news/9-security/10-core-security/340-20110401-core-information-disclosure.html
http://www.joomla.org/announcements/release-news/5367-joomla-1523-released.html
http://www.openwall.com/lists/oss-security/2011/07/01/1
https://exchange.xforce.ibmcloud.com/vulnerabilities/68883
http://developer.joomla.org/security/news/9-security/10-core-security/340-20110401-core-information-disclosure.html
http://www.joomla.org/announcements/release-news/5367-joomla-1523-released.html
http://www.openwall.com/lists/oss-security/2011/07/01/1
https://exchange.xforce.ibmcloud.com/vulnerabilities/68883

Get alerted when CVE-2011-2889 or the next vulnerability affects your stack