CakePHP SecurityComponent cross form submission issue
Moderate severity
GitHub Reviewed
Published
Jan 20, 2023
to the GitHub Advisory Database
•
Updated Jan 20, 2023
Package
Affected versions
>= 2.0.0, < 2.4.8
>= 1.3.0, < 1.3.18
Patched versions
2.4.8
1.3.18
Description
Published to the GitHub Advisory Database
Jan 20, 2023
Reviewed
Jan 20, 2023
Last updated
Jan 20, 2023
Prior to versions 2.4.8 and 1.3.18, forms secured by SecurityComponent could be submitted to any action without triggering SecurityComponent’s tampering protection. If an application contained multiple POST forms to manipulate the same models, it could be vulnerable to mass assignment issues.
References