In short
- CVE-2020-15400 is a MEDIUM (CVSS 4.3) vulnerability affecting cakephp/cakephp, cakephp (cakefoundation).
- Chance of exploitation in the next 30 days (EPSS): 0.45%, higher than 38.8% of all vulnerabilities.
- Fix: update to 4.0.6, 3.10.3 or later.
| Package | Affected versions | Patched versions |
|---|
| cakephp/cakephp Packagist | ≥ 4.0.0, < 4.0.6< 3.10.3
| 4.0.63.10.3
|
| cakephp | < 4.0.6
| 4.0.6
|
Description
CakePHP before 4.0.6 and 3.10.3 mishandles CSRF token generation. This might be remotely exploitable in conjunction with XSS.
NVD description
CakePHP before 4.0.6 mishandles CSRF token generation. This might be remotely exploitable in conjunction with XSS.
More vulnerabilities in cakephp/cakephp
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free