p PatchFirst

CVE-2010-4335

CVE-2010-4335

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The _validatePost function in libs/controller/components/security.php in CakePHP 1.3.x through 1.3.5 and 1.2.8 allows remote attackers to modify the internal Cake cache and execute arbitrary code via a crafted data[_Token][fields] value that is processed by the unserialize function, as demonstrated by modifying the file_map cache to execute arbitrary local files.

EPSS 55.2% · Public exploit · Fix available

Published
Updated

Stack: system · php

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • cakephp Debian:11

    Affected ranges
    • ECOSYSTEM: < 1.3.2-1.1

    Update to 1.3.2-1.1

  • cakephp/cakephp Packagist

    Affected ranges
    • ECOSYSTEM: ≥ 1.2.8, < 1.3.6

    Update to 1.3.6

Original sources

Check your server →