{"action":"Upgrade cakephp/cakephp to 2.0.99 or later.","affected":[{"fixed":"2.0.99","introduced":"2.0.0"},{"fixed":"2.1.99","introduced":"2.1.0"},{"fixed":"2.2.99","introduced":"2.2.0"},{"fixed":"2.3.99","introduced":"2.3.0"},{"fixed":"2.4.99","introduced":"2.4.0"},{"fixed":"2.5.9","introduced":"2.5.0"},{"fixed":"2.6.11","introduced":"2.6.0"},{"fixed":"2.7.2","introduced":"2.7.0"}],"component":"cakephp/cakephp","cve_ids":[],"ecosystem":"Packagist","exploited":false,"fixed_versions":["2.0.99","2.1.99","2.2.99","2.3.99","2.4.99","2.5.9","2.6.11","2.7.2"],"ghsa_id":"GHSA-6hg4-vp5q-47mw","id":"tcs_01M5KEX39TNARQWX7FPM3DAWT9","modified_at":"2024-11-29T05:38:49.564107Z","published_at":"2023-01-20T23:34:05Z","references":["https://osv.dev/vulnerability/GHSA-6hg4-vp5q-47mw","https://github.com/cakephp/cakephp/commit/056f24a77428ad35e23cab6840a72b7c25c4ccc0","https://bakery.cakephp.org/2015/08/06/cakephp_2_5_9_2_6_10_2_7_2_released.html","https://github.com/FriendsOfPHP/security-advisories/blob/master/cakephp/cakephp/2015-08-06.yaml","https://github.com/cakephp/cakephp","https://github.com/cakephp/cakephp/releases/tag/2.5.9","https://github.com/cakephp/cakephp/releases/tag/2.6.11","https://github.com/cakephp/cakephp/releases/tag/2.7.2"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-6hg4-vp5q-47mw","url":"https://osv.dev/vulnerability/GHSA-6hg4-vp5q-47mw"}],"summary":"CakePHP allows direct access of prefixed controller actions"}