| Package | Affected versions | Patched versions |
|---|---|---|
| cakephp/authentication | ≥ 3.0.0, < 3.3.6≥ 4.0.0, < 4.1.1< 2.11.1 | 3.3.64.1.12.11.1 |
| cakephp | ≥ 3.0.0, < 3.3.6≥ 4.0.0, < 4.1.1< 2.11.1 | 3.3.64.1.12.11.1 |
The getLoginRedirect() method contains a weakness to backslash bypasses allowing redirect targets with attacker controlled hostnames.
2.11.1, 3.3.6 and 4.1.1 contain a fix for this issue.
If you are unable to upgrade, you should consider adding application validation to the redirect query string parameter to mitigate this vulnerability.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free