CakePHP 1.3.7 allows remote attackers to obtain sensitive information via a direct request to a .php file

中 5.0CVE-2011-3712 · GHSA-r7p6-fr3x-r877 · 23/09/2011 公開 · 16/06/2026 更新

パッケージ	影響を受けるバージョン	修正済みバージョン
cakephp/cakephp Packagist	`≥ 1.3.7, < 1.3.8`	`1.3.8`
cakephp cakephp	`= 1.3.7`	修正版なし

概要

CakePHP 1.3.7 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by dispatcher.php and certain other files.

NVD の説明

CakePHP 1.3.7 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by dispatcher.php and certain other files.

参考情報

nvd.nist.gov/vuln/detail/CVE-2011-3712 · ADVISORY
cakephp/cakephp · PACKAGE
code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README · WEB
code.google.com/p/inspathx/source/browse/trunk/paths_vuln/cakephp-1.3.7 · WEB
openwall.com/lists/oss-security/2011/06/27/6 · WEB

これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。

無料でサイトをスキャン