GHSA-p76f-wr22-4rv6mediumNo CVE assigned
CakePHP vulnerable to Remote File Inclusion through View template name manipulation
Impact
CakePHP 2.x prior to 2.0.99, 2.1.99, 2.2.99, 2.3.99, 2.4.99, 2.5.99, 2.6.12, and 2.7.6 and 3.x prior to 3.0.15 and 3.1.4 is vulnerable to Remote File Inclusion through View template name manipulation.
Source excerpt · OSVAffected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
cakephp/cakephp Packagist
| Affected range | Recorded fix |
|---|---|
| From 2.0.0 before 2.0.99Ecosystem versions | 2.0.99 |
| From 2.1.0 before 2.1.99Ecosystem versions | 2.1.99 |
| From 2.2.0 before 2.2.99Ecosystem versions | 2.2.99 |
| From 2.3.0 before 2.3.99Ecosystem versions | 2.3.99 |
| From 2.4.0 before 2.4.99Ecosystem versions | 2.4.99 |
| From 2.5.0 before 2.5.99Ecosystem versions | 2.5.99 |
| From 2.6.0 before 2.6.12Ecosystem versions | 2.6.12 |
| From 2.7.0 before 2.7.6Ecosystem versions | 2.7.6 |
| From 3.0.0 before 3.0.15Ecosystem versions | 3.0.15 |
| From 3.1.0 before 3.1.4Ecosystem versions | 3.1.4 |
Version evidence: OSV · GHSA-p76f-wr22-4rv6
View original version evidence (53 explicit versions)
Original source description
CakePHP 2.x prior to 2.0.99, 2.1.99, 2.2.99, 2.3.99, 2.4.99, 2.5.99, 2.6.12, and 2.7.6 and 3.x prior to 3.0.15 and 3.1.4 is vulnerable to Remote File Inclusion through View template name manipulation.
References
- Patch github.com/cakephp/cakephp/commit/5e60cc5d182e6131e3fbdfdf69f49d560c9ff78b
- Source reference bakery.cakephp.org/2015/11/05/cakephp_3015_314_2612_276_released.html
- Security advisory github.com/FriendsOfPHP/security-advisories/blob/master/cakephp/cakephp/2015-11-05.yaml
- Source reference github.com/cakephp/cakephp