GHSA-829q-v5g8-hhxc
GHSA-829q-v5g8-hhxc · CakePHP has incorrect Cross-Site Request Forgery validation
This page contains facts from public vulnerability sources. Check the original advisory before updating.
CsrfComponent fails to invalidate requests that are missing both the CSRF token, and CSRF post data.
Fix available
- Published
- Updated
Stack: php
Affected products and versions
cakephp/cakephp Packagist
- Versions
- 3.0.0
- 3.0.1
- 3.0.2
- 3.0.3
- Affected ranges
- ECOSYSTEM: ≥ 3.0.0, < 3.0.4
Update to 3.0.4
Original sources
- https://github.com/cakephp/cakephp/commit/522ed2f1fb49b00001c1ef8815a6feda790d61dd
- https://bakery.cakephp.org/2015/05/07/cakephp_3_0_4_released.html
- https://github.com/FriendsOfPHP/security-advisories/blob/master/cakephp/cakephp/2015-05-07.yaml
- https://github.com/cakephp/cakephp
- https://osv.dev/vulnerability/GHSA-829q-v5g8-hhxc