PT-2023-33038 · Unknown · Securitycomponent

Publicado 2023-01-20 · Atualizado 2023-01-20

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Software versions prior to 2.4.8 and 1.3.18

Description The issue allows forms secured by SecurityComponent to be submitted to any action without triggering the tampering protection. This could lead to mass assignment issues in applications with multiple POST forms that manipulate the same models.

Recommendations For versions prior to 2.4.8, update to version 2.4.8 or later to resolve the issue. For versions prior to 1.3.18, update to version 1.3.18 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive actions that could be exploited through mass assignment issues until a patch is available.

Identificadores relacionados

GHSA-J9Q2-F9Q7-JHGQ

Produtos afetados

Securitycomponent

Referências · 5

• https://github.com/cakephp/cakephp · Nota
• https://github.com/cakephp/cakephp/commit/f23d811ff59c50ef278e98bb75f4ec1e7e54a5b3 · Nota
• https://github.com/FriendsOfPHP/security-advisories/blob/master/cakephp/cakephp/2014-04-29.yaml · Nota
• https://osv.dev/vulnerability/GHSA-j9q2-f9q7-jhgq · Aviso do Fabricante
• https://bakery.cakephp.org/2014/04/29/CakePHP-1-3-18-and-2-4-8-released.html · Nota