CakePHP allows direct access of prefixed controller actions

MEDIOGHSA-6hg4-vp5q-47mw · Published 20/01/2023 · updated 29/11/2024

En resumen

Package	Affected versions	Patched versions
cakephp/cakephp Packagist	`≥ 2.0.0, < 2.0.99≥ 2.1.0, < 2.1.99≥ 2.2.0, < 2.2.99≥ 2.3.0, < 2.3.99≥ 2.4.0, < 2.4.99≥ 2.5.0, < 2.5.9≥ 2.6.0, < 2.6.11≥ 2.7.0, < 2.7.2`	`2.0.992.1.992.2.992.3.992.4.992.5.92.6.112.7.2`

Unconventional URL paths would allow direct access to prefixed actions without setting the correct request parameters.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

Packagist

≥ 2.0.0, < 2.0.99≥ 2.1.0, < 2.1.99≥ 2.2.0, < 2.2.99≥ 2.3.0, < 2.3.99≥ 2.4.0, < 2.4.99≥ 2.5.0, < 2.5.9≥ 2.6.0, < 2.6.11≥ 2.7.0, < 2.7.2

2.0.992.1.992.2.992.3.992.4.992.5.92.6.112.7.2

Más vulnerabilidades de cakephp/cakephp

Ver todo →