GHSA-6hg4-vp5q-47mw json
CakePHP allows direct access of prefixed controller actions
published 3y ago modified last yr.
- cvss
- —
- not scored
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no score, EPSS covers CVEs only
- public exploits
- 0
- none known
Summary
Unconventional URL paths would allow direct access to prefixed actions without setting the correct request parameters.
Patch / fix
- packagist cakephp/cakephp 2.0.99, 2.1.99, 2.2.99, 2.3.99, 2.4.99, 2.5.9, 2.6.11, 2.7.2
Is GHSA-6hg4-vp5q-47mw in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerAffected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | cakephp/cakephp | >=2.0.0, <2.0.99 >=2.1.0, <2.1.99 >=2.2.0, <2.2.99 >=2.3.0, <2.3.99 >=2.4.0, <2.4.99 >=2.5.0, <2.5.9 >=2.6.0, <2.6.11 >=2.7.0, <2.7.2 |
2.0.99 2.1.99 2.2.99 2.3.99 2.4.99 2.5.9 2.6.11 2.7.2 |
References
-
github.com
/cakephp/cakephp/commit/056f24a77428ad35e23cab6840a72b7c25c4ccc0
web
-
bakery.cakephp.org
/2015/08/06/cakephp_2_5_9_2_6_10_2_7_2_released.html
web
-
github.com
/FriendsOfPHP/security-advisories/blob/master/cakephp/cakephp/2015-08-06.yaml
web
-
github.com
/cakephp/cakephp
package
-
github.com
/cakephp/cakephp/releases/tag/2.5.9
web
-
github.com
/cakephp/cakephp/releases/tag/2.6.11
web
-
github.com
/cakephp/cakephp/releases/tag/2.7.2
web
Sources
- GitHub Advisory GHSA-6hg4-vp5q-47mw
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.