| Package | Affected versions | Patched versions |
|---|---|---|
| cakephp/cakephp | ≥ 1.3.0, < 1.3.18≥ 2.0.0, < 2.4.8 | 1.3.182.4.8 |
Prior to versions 2.4.8 and 1.3.18, forms secured by SecurityComponent could be submitted to any action without triggering SecurityComponent’s tampering protection. If an application contained multiple POST forms to manipulate the same models, it could be vulnerable to mass assignment issues.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free