GitHub Advisoryadvisory · Packagist

GHSA-p76f-wr22-4rv6 CakePHP vulnerable to Remote File Inclusion through View template name manipulation

MEDIUM Published 2023-01-20 Modified 2023-01-20 Official page ↗
Ecosystem
Packagist
Packages
cakephp/cakephp
Severity
Moderate
Reviewed
2023-01-20

Affected packages

• Packagist cakephp/cakephp: >= 2.0.0, < 2.0.99 → fixed in 2.0.99 • Packagist cakephp/cakephp: >= 2.1.0, < 2.1.99 → fixed in 2.1.99 • Packagist cakephp/cakephp: >= 2.2.0, < 2.2.99 → fixed in 2.2.99 • Packagist cakephp/cakephp: >= 2.3.0, < 2.3.99 → fixed in 2.3.99 • Packagist cakephp/cakephp: >= 2.4.0, < 2.4.99 → fixed in 2.4.99 • Packagist cakephp/cakephp: >= 2.5.0, < 2.5.99 → fixed in 2.5.99 • Packagist cakephp/cakephp: >= 2.6.0, < 2.6.12 → fixed in 2.6.12 • Packagist cakephp/cakephp: >= 2.7.0, < 2.7.6 → fixed in 2.7.6 • Packagist cakephp/cakephp: >= 3.0.0, < 3.0.15 → fixed in 3.0.15 • Packagist cakephp/cakephp: >= 3.1.0, < 3.1.4 → fixed in 3.1.4

Description

CakePHP 2.x prior to 2.0.99, 2.1.99, 2.2.99, 2.3.99, 2.4.99, 2.5.99, 2.6.12, and 2.7.6 and 3.x prior to 3.0.15 and 3.1.4 is vulnerable to Remote File Inclusion through View template name manipulation.

References