PT-2023-33046 · Cakephp · Cakephp

Published 2023-01-20 · Updated 2023-01-20

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions CakePHP versions 2.x prior to 2.7.6 CakePHP versions 3.x prior to 3.1.4

Description The issue allows for Remote File Inclusion through View template name manipulation.

Recommendations For CakePHP versions 2.x prior to 2.7.6, update to version 2.7.6 or later. For CakePHP versions 3.x prior to 3.1.4, update to version 3.1.4 or later.

Related Identifiers

GHSA-P76F-WR22-4RV6

Affected Products

Cakephp

References · 5

• https://osv.dev/vulnerability/GHSA-p76f-wr22-4rv6 · Vendor Advisory
• https://github.com/cakephp/cakephp · Note
• https://github.com/cakephp/cakephp/commit/5e60cc5d182e6131e3fbdfdf69f49d560c9ff78b · Note
• https://github.com/FriendsOfPHP/security-advisories/blob/master/cakephp/cakephp/2015-11-05.yaml · Note
• https://bakery.cakephp.org/2015/11/05/cakephp_3015_314_2612_276_released.html · Note