{"action":"Upgrade cakephp/cakephp to 3.4.14 or later.","affected":[{"fixed":"3.4.14","introduced":"3.4.0"},{"fixed":"3.5.17","introduced":"3.5.0"},{"fixed":"3.6.4","introduced":"3.6.0"}],"component":"cakephp/cakephp","cve_ids":[],"ecosystem":"Packagist","exploited":false,"fixed_versions":["3.4.14","3.5.17","3.6.4"],"ghsa_id":"GHSA-xwhj-pqcg-8rcr","id":"tcs_01M5KFBDSYXTFQTTE5F082ERQC","modified_at":"2024-11-29T05:41:07.087696Z","published_at":"2023-01-20T23:35:17Z","references":["https://osv.dev/vulnerability/GHSA-xwhj-pqcg-8rcr","https://github.com/cakephp/cakephp/commit/1ea0c87de729e0dcd53eb6fe3bc86ba739121d8e","https://bakery.cakephp.org/2018/05/20/cakephp_364_3517_3414_released.html","https://github.com/FriendsOfPHP/security-advisories/blob/master/cakephp/cakephp/2018-05-20.yaml","https://github.com/cakephp/cakephp"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-xwhj-pqcg-8rcr","url":"https://osv.dev/vulnerability/GHSA-xwhj-pqcg-8rcr"}],"summary":"CakePHP vulnerable to Cross-site Scripting in some development error pages"}