PT-2023-33038 · Unknown · Securitycomponent

Published 2023-01-20 · Updated 2023-01-20

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Software versions prior to 2.4.8 and 1.3.18

Description The issue allows forms secured by SecurityComponent to be submitted to any action without triggering the tampering protection. This could lead to mass assignment issues in applications with multiple POST forms that manipulate the same models.

Recommendations For versions prior to 2.4.8, update to version 2.4.8 or later to resolve the issue. For versions prior to 1.3.18, update to version 1.3.18 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive actions that could be exploited through mass assignment issues until a patch is available.

Related Identifiers

GHSA-J9Q2-F9Q7-JHGQ

Affected Products

Securitycomponent

References · 5

• https://osv.dev/vulnerability/GHSA-j9q2-f9q7-jhgq · Vendor Advisory
• https://github.com/cakephp/cakephp · Note
• https://github.com/cakephp/cakephp/commit/f23d811ff59c50ef278e98bb75f4ec1e7e54a5b3 · Note
• https://github.com/FriendsOfPHP/security-advisories/blob/master/cakephp/cakephp/2014-04-29.yaml · Note
• https://bakery.cakephp.org/2014/04/29/CakePHP-1-3-18-and-2-4-8-released.html · Note