Directly accessing the URL of files that are related to Magento Connect produces an exception that included the server path. The exception was generated regardless of the configuration settings that control the display of exceptions.There was a low risk of attackers gaining a sufficient understanding of the site structure to target an attack.
Part of patch SUPEE-6285
This vulnerability affects the following application versions:
- Magento 1.5.0.1
- Magento 1.5.1.0
- Magento 1.6.0.0
- Magento 1.6.1.0
- Magento 1.6.2.0
- Magento 1.7.0.0
- Magento 1.7.0.1
- Magento 1.7.0.2
- Magento 1.8.0.0
- Magento 1.8.1.0
- Magento 1.9.0.0
- Magento 1.9.0.1
- Magento 1.9.1.0
- Magento 1.9.1.1