AIKIDO-2024-10535
cakephp/cakephp is vulnerable to Improper Encoding or Escaping of Output
19
Low Risk
This Affects:
cakephp/cakephpTL;DR
Affected versions of this package are vulnerable to improper output encoding or escaping. The issue stems from using PATH_INFO instead of REQUEST_URI. Since PATH_INFO includes URL-decoded values, encoded URLs may improperly match routes they should not, leading to security risks. This flaw allows characters like %2f to bypass routing restrictions, potentially exposing unintended resources. Switching to REQUEST_URI ensures proper handling of encoded URLs and mitigates this vulnerability.
Who does this affect?
You are affected if you are using a vulnerable version of the package.
Background info
cakephp/cakephp is vulnerable to Improper Encoding or Escaping of Output in versions 4.0.0 - 5.1.3.
How to fix this
Upgrade the cakephp/cakephp library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.