CVE-2020-35239
High
Description
A vulnerability exists in CakePHP versions 4.0.x through 4.1.3. The CsrfProtectionMiddleware component allows method override parameters to bypass CSRF checks by changing the HTTP request method to an arbitrary string that is not in the list of request methods that CakePHP checks. Additionally, the route middleware does not verify that this overriden method (which can be an arbitrary string) is actually an HTTP method.
SeverityHigh
CVSS8.8
Exploit probability—
Product
Cakephp
PublishedJan 26, 2021
First seenJan 26, 2021
How to fix
Update
- cakephp/cakephp4.0.10, 4.1.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cakephp cakephp | 4.0.0 ≤ v ≤ 4.1.3 | — |
| cakephp/cakephpPackagist | 4.0.0 ≤ v < 4.0.10, 4.1.0 ≤ v < 4.1.4 | 4.0.10, 4.1.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.