GHSA-j9q2-f9q7-jhgqmedium
CakePHP SecurityComponent cross form submission issue
No CVE assignedCheck your stack
The advisory, in context
Prior to versions 2.4.8 and 1.3.18, forms secured by SecurityComponent could be submitted to any action without triggering SecurityComponent’s tampering protection. If an application contained multiple POST forms to manipulate the same models, it could be vulnerable to mass assignment issues.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
cakephp/cakephp Packagist
Ecosystem versions
From 2.0.0 before 2.4.8
Fixed in 2.4.8
3 explicitly affected versions
2.4.5, 2.4.6, 2.4.7
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.4.8"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.4.5",
"2.4.6",
"2.4.7"
]
}cakephp/cakephp Packagist
Ecosystem versions
From 1.3.0 before 1.3.18
Fixed in 1.3.18
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "1.3.0"
},
{
"fixed": "1.3.18"
}
],
"type": "ECOSYSTEM"
}
],
"versions": []
}