CVE-2011-2891

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2011-07-27 · updated 2026-06-16
Weakness: CWE-200

Description

Joomla! 1.6.x before 1.6.2 allows remote attackers to obtain sensitive information via an empty Itemid array parameter to index.php, which reveals the installation path in an error message, a different vulnerability than CVE-2011-2488.

Affected products

Joomla!: 1.6-alpha, 1.6-alpha2, 1.6-beta1, 1.6-beta10, 1.6-beta11, 1.6-beta12 (+14)

References

http://bl0g.yehg.net/2011/04/joomla-161-and-lower-information.html
http://developer.joomla.org/security/news/341-20110402-core-information-disclosure.html
http://www.openwall.com/lists/oss-security/2011/06/27/6
http://www.openwall.com/lists/oss-security/2011/06/27/8
https://exchange.xforce.ibmcloud.com/vulnerabilities/68881
http://bl0g.yehg.net/2011/04/joomla-161-and-lower-information.html
http://developer.joomla.org/security/news/341-20110402-core-information-disclosure.html
http://www.openwall.com/lists/oss-security/2011/06/27/6
http://www.openwall.com/lists/oss-security/2011/06/27/8
https://exchange.xforce.ibmcloud.com/vulnerabilities/68881

Get alerted when CVE-2011-2891 or the next vulnerability affects your stack