PT-2023-33046 · Cakephp · Cakephp

Publicado 2023-01-20 · Atualizado 2023-01-20

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions CakePHP versions 2.x prior to 2.7.6 CakePHP versions 3.x prior to 3.1.4

Description The issue allows for Remote File Inclusion through View template name manipulation.

Recommendations For CakePHP versions 2.x prior to 2.7.6, update to version 2.7.6 or later. For CakePHP versions 3.x prior to 3.1.4, update to version 3.1.4 or later.

Identificadores relacionados

GHSA-P76F-WR22-4RV6

Produtos afetados

Cakephp

Referências · 5

• https://github.com/cakephp/cakephp · Nota
• https://github.com/cakephp/cakephp/commit/5e60cc5d182e6131e3fbdfdf69f49d560c9ff78b · Nota
• https://github.com/FriendsOfPHP/security-advisories/blob/master/cakephp/cakephp/2015-11-05.yaml · Nota
• https://bakery.cakephp.org/2015/11/05/cakephp_3015_314_2612_276_released.html · Nota
• https://osv.dev/vulnerability/GHSA-p76f-wr22-4rv6 · Aviso do Fabricante