Support

Admin Tools

#13785 pathDisclosure

Posted in ‘Admin Tools for Joomla! 4 & 5’
This is a public ticket

Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.

Environment Information

Joomla! version
n/a
PHP version
n/a
Admin Tools version
n/a

Latest post by nicholas on Thursday, 11 October 2012 16:57 CDT

Thursday, 11 October 2012 07:05 CDT

user69184
Mandatory information about my setup:

Have I read the related troubleshooter articles above before posting (which pages?)? No
Have I searched the tickets before posting? No
Have I read the documentation before posting (which pages?)? No
Joomla! version: (unknown)
PHP version: (unknown)
MySQL version: (unknown)
Host: (optional, but it helps us help you)
Admin Tools version: (unknown)

Description of my issue:

by scanning with w3af tells me this vulnerability pathDisclosure
I noticed in the logs that you see a lot of data .... how can you protect yourself?


sorry I was wrong with copying and pasting

Thursday, 11 October 2012 07:28 CDT

nicholas
The log files and log pages are private, i.e. they are not read by the general public. They are only read by trusted administrators. Seeing privileged information in the logs does not constitute a security breach.

The scanner you are using, the one which reports path disclosure, should also give you the affected URL. If you can please provide it we can further discuss what is going on and how you can protect yourself.

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Thursday, 11 October 2012 16:56 CDT

user69184
has a path disclosure vulnerability which discloses: "/media/system/js/core.js". This vulnerability was found in the request with id 235.

Thursday, 11 October 2012 16:57 CDT

nicholas
No. Having a page reference a Javascript file which is meant to be web accessible is not a path disclosure vulnerability. It's an incompetent web scanner giving a false alarm. Ignore it.

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Support Information

Working hours: We are open Monday to Friday, 9am to 7pm Cyprus timezone (EET / EEST). Support is provided by the same developers writing the software, all of which live in Europe. You can still file tickets outside of our working hours, but we cannot respond to them until we're back at the office.

Support policy: We would like to kindly inform you that when using our support you have already agreed to the Support Policy which is part of our Terms of Service. Thank you for your understanding and for helping us help you!