8.8high
CVE-2020-35239
CakePHP allows method override parameters to bypass CSRF checks
Also known as GHSA-9pgx-pf36-w46r
Published 5 y ago · modified 4 mo ago · JSON
CVSS
8.8
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
0.6%
percentile 49%
Public exploits
0
none known
Summary
A vulnerability exists in CakePHP versions 4.0.x through 4.1.3. The CsrfProtectionMiddleware component allows method override parameters to bypass CSRF checks by changing the HTTP request method to an arbitrary string that is not in the list of request methods that CakePHP checks. Additionally, the route middleware does not verify that this overriden method (which can be an arbitrary string) is actually an HTTP method.
Exploit prediction (EPSS)
0.61% probability of exploitation in the next 30 days, higher than 49% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
| GitHub | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| packagist | cakephp/cakephp | >=4.0.0, <4.0.10 >=4.1.0, <4.1.4 | 4.0.10 4.1.4 |
Classification
- Weakness
- CWE-352 Cross-Site Request Forgery
References
- bakery.cakephp.org /2020/12/07/cakephp_4010_released.html · x_refsource_MISC, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2020-35239 · advisory
- github.com /cakephp/cakephp · package
Sources
- CVE List: CVE-2020-35239
- GitHub Advisory: GHSA-9pgx-pf36-w46r
- NVD: CVE-2020-35239
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.