-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from hash generation in SecurityComponent and FormHelper not including the target action URL. The patch added the request URL (via $this->request->here()) to the hash input. The _validatePost method in SecurityComponent.php and the secure method in FormHelper.php were both modified to include this value, directly addressing the cross-form submission issue. The test case updates showing changed hash values confirm these were the vulnerable functions.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| cakephp/cakephp | composer | >= 2.0.0, < 2.4.8 | 2.4.8 |
| cakephp/cakephp | composer | >= 1.3.0, < 1.3.18 | 1.3.18 |