PT-2023-33075 · Cakephp · Cakephp

Published 2023-01-20 · Updated 2023-01-20

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions CakePHP versions 3.4 prior to 3.4.14 CakePHP versions 3.5 prior to 3.5.17 CakePHP versions 3.6 prior to 3.6.4

Description The issue is a cross-site-scripting (XSS) vulnerability found in the development only missing route and duplicate named route error pages.

Recommendations For CakePHP versions 3.4 prior to 3.4.14, update to version 3.4.14 or later. For CakePHP versions 3.5 prior to 3.5.17, update to version 3.5.17 or later. For CakePHP versions 3.6 prior to 3.6.4, update to version 3.6.4 or later.

Related Identifiers

GHSA-XWHJ-PQCG-8RCR

Affected Products

Cakephp

References · 5

• https://osv.dev/vulnerability/GHSA-xwhj-pqcg-8rcr · Vendor Advisory
• https://github.com/cakephp/cakephp · Note
• https://github.com/cakephp/cakephp/commit/1ea0c87de729e0dcd53eb6fe3bc86ba739121d8e · Note
• https://github.com/FriendsOfPHP/security-advisories/blob/master/cakephp/cakephp/2018-05-20.yaml · Note
• https://bakery.cakephp.org/2018/05/20/cakephp_364_3517_3414_released.html · Note