medium4.3
CVE-2020-15400
Cross-Site Request Forgery in CakePHP
Impact
CakePHP before 4.0.6 and 3.10.3 mishandles CSRF token generation. This might be remotely exploitable in conjunction with XSS.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | cakephp/cakephp | >= 4.0.0, < 4.0.6 | 4.0.6 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Cakefoundation | Cakephp | before 4.0.6 |