Packagist/cakephp/cakephp: medium
CakePHP vulnerable to Cross-site Scripting in some development error pages
Action: Upgrade cakephp/cakephp to 3.4.14 or later.
composer require cakephp/cakephp:3.4.14composer require cakephp/cakephp:3.5.17composer require cakephp/cakephp:3.6.4Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.4.0 | 3.4.14 | - |
| 3.5.0 | 3.5.17 | - |
| 3.6.0 | 3.6.4 | - |
Fixed versions
| 3.4.14 | 3.5.17 | 3.6.4 |
Sources
- osv: GHSA-xwhj-pqcg-8rcr
- https://github.com/cakephp/cakephp/commit/1ea0c87de729e0dcd53eb6fe3bc86ba739121d8e
- https://bakery.cakephp.org/2018/05/20/cakephp_364_3517_3414_released.html
- https://github.com/FriendsOfPHP/security-advisories/blob/master/cakephp/cakephp/2018-05-20.yaml
- https://github.com/cakephp/cakephp
published · modified · JSON