TI-2011-03269 Aliases CVE-2011-3712 GHSA-r7p6-fr3x-r877

CakePHP 1.3.7 allows remote attackers to obtain sensitive information via a direct…

LOW 26CWE-200Published 2011-09-23 · Updated 2024-09-17

Key facts

Attack vector: Network
Privileges required: None
User interaction: — Not recorded in CVSS 2.0
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: Partial · None · None
Fix status: Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

CakePHP 1.3.7 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by dispatcher.php and certain other files.

Why it matters now

EPSS 0.0158 75th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed cakephp/cakephp (Packagist): 1.3.8

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA
—	cakephp/cakephp (Packagist)	1.3.7 to before 1.3.8	1.3.8	Patch available	GHSA-r7p6-fr3x-r877

— Vendor— Affected all versions Fixed in — No fix listed CNA
cakephp/cakephp (Packagist) Vendor— Affected 1.3.7 to before 1.3.8 Fixed in 1.3.8 Patch available GHSA-r7p6-fr3x-r877

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:cakephp:cakephp:1.3.7:::::::*	1.3.7	Vulnerable	cakephp

cpe:2.3:a:cakephp:cakephp:1.3.7:*:*:*:*:*:*:* Versions 1.3.7 Vulnerable ·cakephp

Remediation

Fix · GHSA-r7p6-fr3x-r877 cakephp/cakephp (Packagist) Fixed in 1.3.8 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2011-3712
2026-10-03 Alias added: GHSA-r7p6-fr3x-r877

References

Exploit 1

http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/cakephp-1.3.7

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2011-3712

Other 3

TI-2010-04068 The _validatePost function in libs/controller/components/security.php in CakePHP 1.3.x… CVSS 2.0HIGH 7.5
TI-2026-19037 CakePHP PaginatorHelper::limitControl() vulnerable to reflected cross-site-scripting CVSS 3.1MEDIUM 5.4
TI-2023-08901 Database Query::offset() and limit() vulnerable to SQL injection in cakephp CVSS 3.1CRITICAL 9.8
TI-2016-04142 The clientIp function in CakePHP 3.2.4 and earlier allows remote attackers to spoof their… CVSS 3.0HIGH 7.5
TI-2015-06899 CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF… CVSS 3.0HIGH 8.8
TI-2020-17913 A vulnerability exists in CakePHP versions 4.0.x through 4.1.3. CVSS 3.1HIGH 8.8

See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences