PT-2023-32995 · Unknown · Csrfcomponent

Published 2023-01-20 · Updated 2023-01-20

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions CsrfComponent (affected versions not specified)

Description The issue is related to the CsrfComponent, which fails to invalidate requests that are missing both the CSRF token and CSRF post data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

GHSA-829Q-V5G8-HHXC

Affected Products

Csrfcomponent

References · 5

• https://osv.dev/vulnerability/GHSA-829q-v5g8-hhxc · Vendor Advisory
• https://github.com/cakephp/cakephp · Note
• https://github.com/cakephp/cakephp/commit/522ed2f1fb49b00001c1ef8815a6feda790d61dd · Note
• https://github.com/FriendsOfPHP/security-advisories/blob/master/cakephp/cakephp/2015-05-07.yaml · Note
• https://bakery.cakephp.org/2015/05/07/cakephp_3_0_4_released.html · Note