CVE-2011-3712
CakePHP 1.3.7 allows remote attackers to obtain sensitive information via a direct request to a .php file
EPSS 1.4%
Description
CakePHP 1.3.7 allows remote attackers to obtain sensitive information via a direct request to a `.php` file, which reveals the installation path in an error message, as demonstrated by `dispatcher.php` and certain other files.
How to fix CVE-2011-3712
To remediate CVE-2011-3712, upgrade the affected package to a fixed version below.
- Packagist/cakephp/cakephp—upgrade to 1.3.8 or later
Is CVE-2011-3712 being exploited?
Low — EPSS is 1.4%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- >= 1.3.7, < 1.3.8