GitHub Advisoryadvisory · Packagist

GHSA-q79m-c546-2g63 CakePHP vulnerable to Denial of Service attack through XML payloads

HIGH Published 2023-01-20 Modified 2023-01-20 Official page ↗
Ecosystem
Packagist
Packages
cakephp/cakephp
Severity
High
Reviewed
2023-01-20

Affected packages

• Packagist cakephp/cakephp: >= 3.0.0, < 3.0.6 → fixed in 3.0.6 • Packagist cakephp/cakephp: >= 2.0.0, < 2.0.99 → fixed in 2.0.99 • Packagist cakephp/cakephp: >= 2.1.0, < 2.1.99 → fixed in 2.1.99 • Packagist cakephp/cakephp: >= 2.2.0, < 2.2.99 → fixed in 2.2.99 • Packagist cakephp/cakephp: >= 2.3.0, < 2.3.99 → fixed in 2.3.99 • Packagist cakephp/cakephp: >= 2.4.0, < 2.4.99 → fixed in 2.4.99 • Packagist cakephp/cakephp: >= 2.5.0, < 2.5.90 → fixed in 2.5.90 • Packagist cakephp/cakephp: >= 2.6.0, < 2.6.6 → fixed in 2.6.6

Description

RequestHandlerComponent had a vulnerability that would allow well crafted requests to create a denial of service attack. RequestHandlerComponent leverages `Xml::build()` which allows reading local files. We recommend that all applications using RequestHandlerComponent upgrade, or disable parsing XML payloads.

References