Access Restriction Bypass Affecting cakephp/cakephp package, versions <2.5.9 >=2.6.0, <2.6.11 >=2.7.0, <2.7.2
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PHP-CAKEPHPCAKEPHP-70008
- published 6 Aug 2015
- disclosed 6 Aug 2015
- credit Kurita Takashi
How to fix?
Upgrade cakephp/cakephp to version 2.6.11, 2.7.2, 2.5.9 or higher.
Overview
Affected versions of cakephp/cakephp are vulnerable to Access Restriction Bypass.
Unconventional URL paths would allow direct access to prefixed actions without setting the correct request parameters. If your authorization depends on the presence of the prefix routing key you should upgrade as soon as possible.
References
CVSS Scores
version 3.1