{"id":"GHSA-xwhj-pqcg-8rcr","aliases":[],"title":"CakePHP vulnerable to Cross-site Scripting in some development error pages","description":"CakePHP 3.4 prior to 3.4.14, 3.5 prior to 3.5.17, and 3.6 prior to 3.6.4 contains a cross-site-scripting (XSS) vulnerability in the development only `missing route` and `duplicate named route` error pages.","severity":"medium","score":null,"published":"2023-01-20T23:35:17.000Z","modified":"2024-11-29T05:41:07.087Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"cakephp/cakephp","ranges":[{"events":[{"introduced":"3.4.0"},{"fixed":"3.4.14"}],"type":"ECOSYSTEM"}],"versions":["3.4.0","3.4.1","3.4.10","3.4.11","3.4.12","3.4.13","3.4.2","3.4.3","3.4.4","3.4.5","3.4.6","3.4.7","3.4.8","3.4.9"],"fixed":["3.4.14"]},{"ecosystem":"Packagist","name":"cakephp/cakephp","ranges":[{"events":[{"introduced":"3.5.0"},{"fixed":"3.5.17"}],"type":"ECOSYSTEM"}],"versions":["3.5.0","3.5.1","3.5.10","3.5.11","3.5.12","3.5.13","3.5.14","3.5.15","3.5.16","3.5.2","3.5.3","3.5.4","3.5.5","3.5.6","3.5.7","3.5.8","3.5.9"],"fixed":["3.5.17"]},{"ecosystem":"Packagist","name":"cakephp/cakephp","ranges":[{"events":[{"introduced":"3.6.0"},{"fixed":"3.6.4"}],"type":"ECOSYSTEM"}],"versions":["3.6.0","3.6.1","3.6.2","3.6.3"],"fixed":["3.6.4"]}],"references":["https://github.com/cakephp/cakephp/commit/1ea0c87de729e0dcd53eb6fe3bc86ba739121d8e","https://bakery.cakephp.org/2018/05/20/cakephp_364_3517_3414_released.html","https://github.com/FriendsOfPHP/security-advisories/blob/master/cakephp/cakephp/2018-05-20.yaml","https://github.com/cakephp/cakephp"],"sources":[{"name":"OSV","id":"GHSA-xwhj-pqcg-8rcr","modified":"2024-11-29T05:41:07.087696Z","url":"https://osv.dev/vulnerability/GHSA-xwhj-pqcg-8rcr"}],"assessments":[]}