PT-2023-33052 · Unknown · Requesthandlercomponent

Publicado 2023-01-20 · Atualizado 2023-01-20

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions RequestHandlerComponent (affected versions not specified)

Description The issue allows well-crafted requests to create a denial of service attack. It is related to the use of Xml::build(), which enables reading local files.

Recommendations For all versions of RequestHandlerComponent, consider upgrading to a newer version or disable parsing XML payloads as a temporary workaround to minimize the risk of exploitation.

Identificadores relacionados

GHSA-Q79M-C546-2G63

Produtos afetados

Requesthandlercomponent

Referências · 5

• https://github.com/cakephp/cakephp · Nota
• https://github.com/cakephp/cakephp/commit/c186487151356a8d7c6e2cae05f87b9df0e59fbb · Nota
• https://github.com/FriendsOfPHP/security-advisories/blob/master/cakephp/cakephp/2015-05-28.yaml · Nota
• https://osv.dev/vulnerability/GHSA-q79m-c546-2g63 · Aviso do Fabricante
• https://bakery.cakephp.org/2015/05/28/cakephp_2_6_6_and_3_0_6_released.html · Nota