GitHub Advisoryadvisory · Packagist

GHSA-j9q2-f9q7-jhgq CakePHP SecurityComponent cross form submission issue

MEDIUM Published 2023-01-20 Modified 2023-01-20 Official page ↗

Ecosystem: Packagist
Packages: cakephp/cakephp
Severity: Moderate
Reviewed: 2023-01-20

Affected packages

• Packagist cakephp/cakephp: >= 2.0.0, < 2.4.8 → fixed in 2.4.8 • Packagist cakephp/cakephp: >= 1.3.0, < 1.3.18 → fixed in 1.3.18

Description

Prior to versions 2.4.8 and 1.3.18, forms secured by SecurityComponent could be submitted to any action without triggering SecurityComponent’s tampering protection. If an application contained multiple POST forms to manipulate the same models, it could be vulnerable to mass assignment issues.

References

https://github.com/cakephp/cakephp/commit/f23d811ff59c50ef278e98bb75f4ec1e7e54a5b3 web
https://bakery.cakephp.org/2014/04/29/CakePHP-1-3-18-and-2-4-8-released.html web
https://github.com/FriendsOfPHP/security-advisories/blob/master/cakephp/cakephp/2014-04-29.yaml web
https://github.com/cakephp/cakephp package