GHSA-j9q2-f9q7-jhgq
GHSA-j9q2-f9q7-jhgq · CakePHP SecurityComponent cross form submission issue
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Prior to versions 2.4.8 and 1.3.18, forms secured by SecurityComponent could be submitted to any action without triggering SecurityComponent’s tampering protection. If an application contained multiple POST forms to manipulate the same models, it could be vulnerable to mass assignment issues.
Fix available
- Published
- Updated
Stack: php
Affected products and versions
cakephp/cakephp Packagist
- Versions
- 2.4.5
- 2.4.6
- 2.4.7
- Affected ranges
- ECOSYSTEM: ≥ 2.0.0, < 2.4.8
Update to 2.4.8
cakephp/cakephp Packagist
- Affected ranges
- ECOSYSTEM: ≥ 1.3.0, < 1.3.18
Update to 1.3.18
Original sources
- https://github.com/cakephp/cakephp/commit/f23d811ff59c50ef278e98bb75f4ec1e7e54a5b3
- https://bakery.cakephp.org/2014/04/29/CakePHP-1-3-18-and-2-4-8-released.html
- https://github.com/FriendsOfPHP/security-advisories/blob/master/cakephp/cakephp/2014-04-29.yaml
- https://github.com/cakephp/cakephp
- https://osv.dev/vulnerability/GHSA-j9q2-f9q7-jhgq