PT-2023-33075 · Cakephp · Cakephp

Publicado 2023-01-20 · Atualizado 2023-01-20

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions CakePHP versions 3.4 prior to 3.4.14 CakePHP versions 3.5 prior to 3.5.17 CakePHP versions 3.6 prior to 3.6.4

Description The issue is a cross-site-scripting (XSS) vulnerability found in the development only missing route and duplicate named route error pages.

Recommendations For CakePHP versions 3.4 prior to 3.4.14, update to version 3.4.14 or later. For CakePHP versions 3.5 prior to 3.5.17, update to version 3.5.17 or later. For CakePHP versions 3.6 prior to 3.6.4, update to version 3.6.4 or later.

Identificadores relacionados

GHSA-XWHJ-PQCG-8RCR

Produtos afetados

Cakephp

Referências · 5

• https://github.com/cakephp/cakephp · Nota
• https://github.com/cakephp/cakephp/commit/1ea0c87de729e0dcd53eb6fe3bc86ba739121d8e · Nota
• https://github.com/FriendsOfPHP/security-advisories/blob/master/cakephp/cakephp/2018-05-20.yaml · Nota
• https://osv.dev/vulnerability/GHSA-xwhj-pqcg-8rcr · Aviso do Fabricante
• https://bakery.cakephp.org/2018/05/20/cakephp_364_3517_3414_released.html · Nota