Lack of data validation In cakephp/cakephp
Description
CakePHP: SmtpTransport vulnerable to CRLF header injection
Impact
Custom mail headers added with Message::setHeaders() or addHeaders() do not have CRLF replaced allowing header injection if user controlled data is added to message headers without stripping CRLF bytes.
Patches
5.3.7, 5.2.14, 5.1.9, 4.6.5, 4.5.12 contain fixes for this issue.
Workarounds
You can strip CRLF bytes from email header values before setting header values.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 debian 11 | - | ||
 packagist | 4.5.12, 4.6.5, 5.1.9, 5.2.14, 5.3.7 |
Aliases
1. 2. 3. 4. 5. 6. 7.
References
1. 2. 3. 4. 5.