GitHub Advisoryadvisory · Packagist

GHSA-556q-h4vr-pgh2 CakePHP might allow remote attackers to bypass CSRF protection mechanism via the _method parameter

HIGH Published 2022-05-14 Modified 2023-01-14 Official page ↗
Aliases
CVE-2015-8379
Ecosystem
Packagist
Packages
cakephp/cakephp
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-352
Reviewed
2023-01-14

Affected packages

• Packagist cakephp/cakephp: >= 2.0.0-alpha, < 3.1.5 → fixed in 3.1.5

Description

CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the `_method` parameter.

Related

Alias · CVE (1)

  • CVE-2015-8379 CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the _method parameter. vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References