Description
CakePHP 1.3.7 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by dispatcher.php and certain other files.
Remediation
References
Related Vulnerabilities
WordPress Plugin Launcher:Coming Soon & Maintenance Mode Cross-Site Scripting (1.0.10)
WordPress Plugin Disc Golf Manager PHP Object Injection (1.0.0)
WordPress Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2011-3128)
WordPress Plugin WPS Hide Login Security Bypass (1.5.4.2)
Oracle Application Server CVE-2008-0343 Vulnerability (CVE-2008-0343)