CVE-2011-3734

Name of the Vulnerable Software and Affected Versions Energine version 2.3.8

Description The issue allows remote attackers to obtain sensitive information via a direct request to a .php file. This is achieved by revealing the installation path in an error message. For example, requesting core/framework/SimpleBuilder.class.php and certain other files can expose this information.

Recommendations For Energine version 2.3.8, consider restricting access to sensitive .php files, such as core/framework/SimpleBuilder.class.php, to prevent information disclosure until a patch is available.