Skip to content
Fencer Intel
high —

GHSA-q79m-c546-2g63 json

CakePHP vulnerable to Denial of Service attack through XML payloads

published 3y ago modified last yr.

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

RequestHandlerComponent had a vulnerability that would allow well crafted requests to create a denial of service attack. RequestHandlerComponent leverages `Xml::build()` which allows reading local files. We recommend that all applications using RequestHandlerComponent upgrade, or disable parsing XML payloads.

Patch / fix

  • packagist cakephp/cakephp 2.0.99, 2.1.99, 2.2.99, 2.3.99, 2.4.99, 2.5.90, 2.6.6, 3.0.6

Is GHSA-q79m-c546-2g63 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
packagist cakephp/cakephp
>=3.0.0, <3.0.6
>=2.0.0, <2.0.99
>=2.1.0, <2.1.99
>=2.2.0, <2.2.99
>=2.3.0, <2.3.99
>=2.4.0, <2.4.99
>=2.5.0, <2.5.90
>=2.6.0, <2.6.6
3.0.6
2.0.99
2.1.99
2.2.99
2.3.99
2.4.99
2.5.90
2.6.6

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.