Vulnerability · Published Jan 20, 2021 · Assigned by mitre

CVE-2020-35239

High 8.8

In plain English

A high-severity security flaw in the cakephp/cakephp package (Packagist). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)8.8High

Exploit odds (30 days)0.6%top 50.7% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A vulnerability exists in CakePHP versions 4.0.x through 4.1.3. The CsrfProtectionMiddleware component allows method override parameters to bypass CSRF checks by changing the HTTP request method to an arbitrary string that is not in the list of request methods that CakePHP checks. Additionally, the route middleware does not verify that this overriden method (which can be an arbitrary string) is actually an HTTP method.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	cakephp/cakephp	4.0.10	GHSA-9pgx-pf36-w46r
Packagist	cakephp/cakephp	4.1.4	GHSA-9pgx-pf36-w46r
Ubuntu:22.04:LTS	cakephp	no fix listed	UBUNTU-CVE-2020-35239

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

https://bakery.cakephp.org/2020/12/07/cakephp_4010_released.html x_refsource_MISC