Access Control Bypass Affecting cakephp/cakephp package, versions >=2.0.0, <2.0.99 >=2.1.0, <2.1.99 >=2.2.0, <2.2.99 >=2.3.0, <2.3.99 >=2.4.0, <2.4.99 >=2.5.0, <2.5.9 >=2.6.0, <2.6.11 >=2.7.0, <2.7.2
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PHP-CAKEPHPCAKEPHP-3244388
- published 22 Jan 2023
- disclosed 20 Jan 2023
- credit Unknown
How to fix?
Upgrade cakephp/cakephp to version 2.0.99, 2.1.99, 2.2.99, 2.3.99, 2.4.99, 2.5.9, 2.6.11, 2.7.2 or higher.
Overview
cakephp/cakephp is a rapid development framework for PHP which uses commonly known design patterns like Associative Data Mapping, Front Controller, and MVC.
Affected versions of this package are vulnerable to Access Control Bypass via unconventional URL paths, which allows direct access to prefixed actions without setting the correct request parameters.
References
CVSS Scores
version 3.1