GitHub Advisoryadvisory · Packagist

GHSA-829q-v5g8-hhxc CakePHP has incorrect Cross-Site Request Forgery validation

MEDIUM Published 2023-01-20 Modified 2023-01-20 Official page ↗

Ecosystem: Packagist
Packages: cakephp/cakephp
Severity: Moderate
Weaknesses: CWE-352
Reviewed: 2023-01-20

Affected packages

• Packagist cakephp/cakephp: >= 3.0.0, < 3.0.4 → fixed in 3.0.4

Description

CsrfComponent fails to invalidate requests that are missing both the CSRF token, and CSRF post data.

Related

Weakness · CWE (1)

CWE-352 Cross-Site Request Forgery weakness

References