PT-2023-32983 · Packagist · Cakephp/Cakephp

Published 2023-01-20 · Updated 2023-01-20

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions No specific software or versions mentioned.

Description The issue allows unconventional URL paths to enable direct access to prefixed actions without correctly setting the request parameters.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

GHSA-6HG4-VP5Q-47MW

Affected Products

Cakephp/Cakephp

References · 8

• https://osv.dev/vulnerability/GHSA-6hg4-vp5q-47mw · Vendor Advisory
• https://github.com/cakephp/cakephp · Note
• https://github.com/cakephp/cakephp/releases/tag/2.6.11 · Note
• https://github.com/cakephp/cakephp/commit/056f24a77428ad35e23cab6840a72b7c25c4ccc0 · Note
• https://github.com/cakephp/cakephp/releases/tag/2.5.9 · Note
• https://github.com/cakephp/cakephp/releases/tag/2.7.2 · Note
• https://github.com/FriendsOfPHP/security-advisories/blob/master/cakephp/cakephp/2015-08-06.yaml · Note
• https://bakery.cakephp.org/2015/08/06/cakephp_2_5_9_2_6_10_2_7_2_released.html · Note