Fluid Attacks Database

Description

CakePHP allows direct access of prefixed controller actions Unconventional URL paths would allow direct access to prefixed actions without setting the correct request parameters.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
packagist	cakephp/cakephp	>=2.0.0 <2.0.99 \|\| >=2.1.0 <2.1.99 \|\| >=2.2.0 <2.2.99 \|\| >=2.3.0 <2.3.99 \|\| >=2.4.0 <2.4.99 \|\| >=2.5.0 <2.5.9 \|\| >=2.6.0 <2.6.11 \|\| >=2.7.0 <2.7.2	2.0.99, 2.1.99, 2.2.99, 2.3.99, 2.4.99, 2.5.9, 2.6.11, 2.7.2

Aliases

1. GCVE-GHSA-6hg4-vp5q-47mw

References

1. https://github.com/cakephp/cakephp/commit/056f24a77428ad35e23cab6840a72b7c25c4ccc02. https://bakery.cakephp.org/2015/08/06/cakephp_2_5_9_2_6_10_2_7_2_released.html3. https://github.com/FriendsOfPHP/security-advisories/blob/master/cakephp/cakephp/2015-08-06.yaml4. https://github.com/cakephp/cakephp/releases/tag/2.5.95. https://github.com/cakephp/cakephp/releases/tag/2.6.116. https://github.com/cakephp/cakephp/releases/tag/2.7.2

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.