{"id":"GHSA-829q-v5g8-hhxc","aliases":[],"title":"CakePHP has incorrect Cross-Site Request Forgery validation","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"MODERATE","description":"CsrfComponent fails to invalidate requests that are missing both the CSRF token, and CSRF post data.","severity":"medium","score":null,"published":"2023-01-20T23:02:02.000Z","modified":"2024-11-29T05:49:50.887Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"cakephp/cakephp","sources":[{"name":"OSV · GHSA-829q-v5g8-hhxc","url":"https://osv.dev/vulnerability/GHSA-829q-v5g8-hhxc"}],"ranges":[{"events":[{"introduced":"3.0.0"},{"fixed":"3.0.4"}],"type":"ECOSYSTEM"}],"versions":["3.0.0","3.0.1","3.0.2","3.0.3"],"fixed":["3.0.4"]}],"sourceAffected":[],"references":["https://github.com/cakephp/cakephp/commit/522ed2f1fb49b00001c1ef8815a6feda790d61dd","https://bakery.cakephp.org/2015/05/07/cakephp_3_0_4_released.html","https://github.com/FriendsOfPHP/security-advisories/blob/master/cakephp/cakephp/2015-05-07.yaml","https://github.com/cakephp/cakephp"],"sources":[{"name":"OSV","id":"GHSA-829q-v5g8-hhxc","modified":"2024-11-29T05:49:50.887363Z","url":"https://osv.dev/vulnerability/GHSA-829q-v5g8-hhxc"}],"assessments":[],"products":[],"remediation":[],"kev":{"status":"unavailable","checkedAt":"2026-10-28T18:20:33.032Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}