GHSA-j9q2-f9q7-jhgq
GHSA-j9q2-f9q7-jhgq · CakePHP SecurityComponent cross form submission issue
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Prior to versions 2.4.8 and 1.3.18, forms secured by SecurityComponent could be submitted to any action without triggering SecurityComponent’s tampering protection. If an application contained multiple POST forms to manipulate the same models, it could be vulnerable to mass assignment issues.
Corrección disponible
- Publicación
- Actualización
Pila tecnológica: php
Productos y versiones afectados
cakephp/cakephp Packagist
- Versiones
- 2.4.5
- 2.4.6
- 2.4.7
- Intervalos de versiones afectados
- ECOSYSTEM: ≥ 2.0.0, < 2.4.8
Actualiza a 2.4.8
cakephp/cakephp Packagist
- Intervalos de versiones afectados
- ECOSYSTEM: ≥ 1.3.0, < 1.3.18
Actualiza a 1.3.18
Fuentes originales
- https://github.com/cakephp/cakephp/commit/f23d811ff59c50ef278e98bb75f4ec1e7e54a5b3
- https://bakery.cakephp.org/2014/04/29/CakePHP-1-3-18-and-2-4-8-released.html
- https://github.com/FriendsOfPHP/security-advisories/blob/master/cakephp/cakephp/2014-04-29.yaml
- https://github.com/cakephp/cakephp
- https://osv.dev/vulnerability/GHSA-j9q2-f9q7-jhgq