GHSA-vc29-mvwv-wpcqmedium6.5
Cross-site scripting (XSS) vulnerability in CakePHP
The advisory, in context
Cross-site scripting (XSS) vulnerability in cake/libs/error.php in CakePHP before 1.1.7.3363 allows remote attackers to inject arbitrary web script or HTML via the URL, which is reflected back in a 404 ("Not Found") error page. NOTE: some of these details are obtained from third party information.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
cakephp/cakephp Packagist
Ecosystem versions
From 1.0.1.2708 before 1.1.7.3363
Fixed in 1.1.7.3363
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "1.0.1.2708"
},
{
"fixed": "1.1.7.3363"
}
],
"type": "ECOSYSTEM"
}
],
"versions": []
}