GHSA-p76f-wr22-4rv6

Source

https://github.com/advisories/GHSA-p76f-wr22-4rv6

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/01/GHSA-p76f-wr22-4rv6/GHSA-p76f-wr22-4rv6.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-p76f-wr22-4rv6

Published

2023-01-20T23:35:01Z

Modified

2024-11-29T05:41:07.154891Z

Summary

CakePHP vulnerable to Remote File Inclusion through View template name manipulation

Details

CakePHP 2.x prior to 2.0.99, 2.1.99, 2.2.99, 2.3.99, 2.4.99, 2.5.99, 2.6.12, and 2.7.6 and 3.x prior to 3.0.15 and 3.1.4 is vulnerable to Remote File Inclusion through View template name manipulation.

Database specific

{
    "nvd_published_at": null,
    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-01-20T23:35:01Z"
}

References

Affected packages

Packagist / cakephp/cakephp

Package

Name: cakephp/cakephp
Purl: pkg:composer/cakephp/cakephp

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.0.0

Fixed

2.0.99

Packagist / cakephp/cakephp

Package

Name: cakephp/cakephp
Purl: pkg:composer/cakephp/cakephp

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.1.0

Fixed

2.1.99

Packagist / cakephp/cakephp

Package

Name: cakephp/cakephp
Purl: pkg:composer/cakephp/cakephp

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.2.0

Fixed

2.2.99

Packagist / cakephp/cakephp

Package

Name: cakephp/cakephp
Purl: pkg:composer/cakephp/cakephp

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.3.0

Fixed

2.3.99

Packagist / cakephp/cakephp

Package

Name: cakephp/cakephp
Purl: pkg:composer/cakephp/cakephp

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.4.0

Fixed

2.4.99

Affected versions

2.*

2.4.5

2.4.6

2.4.7

2.4.8

2.4.9

2.4.10

Packagist / cakephp/cakephp

Package

Name: cakephp/cakephp
Purl: pkg:composer/cakephp/cakephp

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.5.0

Fixed

2.5.99

Affected versions

2.*

2.5.0

2.5.1

2.5.2

2.5.3

2.5.4

2.5.5

2.5.6

2.5.7

2.5.8

2.5.9

Packagist / cakephp/cakephp

Package

Name: cakephp/cakephp
Purl: pkg:composer/cakephp/cakephp

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.6.0

Fixed

2.6.12

Affected versions

2.*

2.6.0

2.6.1

2.6.2

2.6.3

2.6.4

2.6.5

2.6.6

2.6.7

2.6.8

2.6.9

2.6.10

2.6.11

Packagist / cakephp/cakephp

Package

Name: cakephp/cakephp
Purl: pkg:composer/cakephp/cakephp

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.7.0

Fixed

2.7.6

Affected versions

2.*

2.7.0

2.7.1

2.7.2

2.7.3

2.7.4

2.7.5

Packagist / cakephp/cakephp

Package

Name: cakephp/cakephp
Purl: pkg:composer/cakephp/cakephp

Affected ranges

Type: ECOSYSTEM
Events: Introduced

3.0.0

Fixed

3.0.15

Affected versions

3.*

3.0.0

3.0.1

3.0.2

3.0.3

3.0.4

3.0.5

3.0.6

3.0.7

3.0.8

3.0.9

3.0.10

3.0.11

3.0.12

3.0.13

3.0.14

Packagist / cakephp/cakephp

Package

Name: cakephp/cakephp
Purl: pkg:composer/cakephp/cakephp

Affected ranges

Type: ECOSYSTEM
Events: Introduced

3.1.0

Fixed

3.1.4

Affected versions

3.*

3.1.0

3.1.1

3.1.2

3.1.3