Vulnerability GHSA-xwhj-pqcg-8rcr
Medium Risk
MEDIUM RISK
CVSS Score: 6.0
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
3 years ago
January 20, 2023 at 11:35 PM UTC
CakePHP vulnerable to Cross-site Scripting in some development error pages
3.4.0 - 3.4.13 and 3.5.0 - 3.5.16 and 3.6.0 - 3.6.3
3.4.0 - 3.4.13 and 3.5.0 - 3.5.16 and 3.6.0 - 3.6.3
Summary
CakePHP vulnerable to Cross-site Scripting in some development error pages
Details
CakePHP 3.4 prior to 3.4.14, 3.5 prior to 3.5.17, and 3.6 prior to 3.6.4 contains a cross-site-scripting (XSS) vulnerability in the development only missing route and duplicate named route error pages.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Critical
1 month ago
CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection
2.4.5 - 4.5.11 and 4.6.0 - 4.6.4 and 5.0.0 - 5.1.8 and 5.2.0 - 5.2.13 and 5.3.0 - 5.3.6 GHSA-vjqc-q4mp-2rvf
2.4.5 - 4.5.11 and 4.6.0 - 4.6.4 and 5.0.0 - 5.1.8 and 5.2.0 - 5.2.13 and 5.3.0 - 5.3.6 GHSA-vjqc-q4mp-2rvf
Critical
1 month ago
CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver
5.1.0 - 5.1.9 and 5.2.0 - 5.2.14 and 5.3.0 - 5.3.6 GHSA-fxf7-vhh8-7vpq
5.1.0 - 5.1.9 and 5.2.0 - 5.2.14 and 5.3.0 - 5.3.6 GHSA-fxf7-vhh8-7vpq
High Risk
1 month ago
CakePHP: SmtpTransport vulnerable to CRLF header injection
4.5.0 - 4.5.11 and 4.6.0 - 4.6.4 and 5.0.0 - 5.1.8 and 5.2.0 - 5.2.13 and 5.3.0 - 5.3.6 GHSA-2qh5-382h-3jpc
4.5.0 - 4.5.11 and 4.6.0 - 4.6.4 and 5.0.0 - 5.1.8 and 5.2.0 - 5.2.13 and 5.3.0 - 5.3.6 GHSA-2qh5-382h-3jpc
Medium Risk
4 months ago
CakePHP: View::element() is missing a path containment check
2.4.5 - 4.5.10 and 4.6.0 - 4.6.3 and 5.0.0 - 5.1.6 and 5.2.0 - 5.2.12 and 5.3.0 - 5.3.5 GHSA-wpvj-hjcr-h3p2
2.4.5 - 4.5.10 and 4.6.0 - 4.6.3 and 5.0.0 - 5.1.6 and 5.2.0 - 5.2.12 and 5.3.0 - 5.3.5 GHSA-wpvj-hjcr-h3p2
Medium Risk
9 months ago
CakePHP PaginatorHelper::limitControl() vulnerable to reflected cross-site-scripting
5.2.10 - 5.2.11 and 5.3.0 GHSA-qh8m-9qxx-53m5
5.2.10 - 5.2.11 and 5.3.0 GHSA-qh8m-9qxx-53m5
Impacted packages
Timeline
Published
3 years ago
January 20, 2023 at 11:35 PM UTC
Fixed (3.6.4)
8 years ago
May 21, 2018 at 12:47 AM UTC
Fixed (3.4.14)
8 years ago
May 21, 2018 at 01:19 AM UTC
Fixed (3.5.17)
8 years ago
May 21, 2018 at 01:31 AM UTC
Last Modified
1 year ago
November 29, 2024 at 05:41 AM UTC