6.8
CVSSv2

CVE-2015-8379

Published: 26/01/2016 Updated: 09/10/2018
CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6
CVSS v3 Base Score: 8.8 | Impact Score: 5.9 | Exploitability Score: 2.8
VMScore: 605
Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Vulnerability Summary

CakePHP 2.x and 3.x prior to 3.1.5 might allow remote malicious users to bypass the CSRF protection mechanism via the _method parameter.

Vulnerable Product Search on Vulmon Subscribe to Product

cakephp cakephp 3.1.1

cakephp cakephp 3.1.0

cakephp cakephp 3.0.11

cakephp cakephp 3.0.10

cakephp cakephp 3.0.3

cakephp cakephp 3.0.2

cakephp cakephp 3.0.0

cakephp cakephp 2.7.7

cakephp cakephp 2.7.6

cakephp cakephp 2.7.0

cakephp cakephp 2.6.12

cakephp cakephp 2.6.5

cakephp cakephp 2.6.4

cakephp cakephp 2.5.8

cakephp cakephp 2.5.7

cakephp cakephp 2.5.0

cakephp cakephp 2.4.6

cakephp cakephp 2.4.5

cakephp cakephp 2.4.4

cakephp cakephp 2.4.0

cakephp cakephp 2.3.10

cakephp cakephp 2.3.3

cakephp cakephp 2.3.2

cakephp cakephp 2.2.7

cakephp cakephp 2.2.6

cakephp cakephp 2.2.0

cakephp cakephp 2.1.0

cakephp cakephp 2.0.1

cakephp cakephp 2.0.0

cakephp cakephp 3.1.3

cakephp cakephp 3.1.2

cakephp cakephp 3.0.13

cakephp cakephp 3.0.12

cakephp cakephp 3.0.5

cakephp cakephp 3.0.4

cakephp cakephp 2.7.9

cakephp cakephp 2.7.8

cakephp cakephp 2.7.1

cakephp cakephp 2.6.7

cakephp cakephp 2.6.6

cakephp cakephp 2.6.0

cakephp cakephp 2.5.9

cakephp cakephp 2.5.2

cakephp cakephp 2.5.1

cakephp cakephp 2.4.8

cakephp cakephp 2.4.7

cakephp cakephp 2.3.5

cakephp cakephp 2.3.4

cakephp cakephp 2.3.0

cakephp cakephp 2.2.9

cakephp cakephp 2.2.8

cakephp cakephp 2.2.1

cakephp cakephp 2.1.2

cakephp cakephp 2.1.1

cakephp cakephp 2.0.3

cakephp cakephp 2.0.2

cakephp cakephp 3.0.9

cakephp cakephp 3.0.8

cakephp cakephp 3.0.1

cakephp cakephp 2.7.5

cakephp cakephp 2.7.4

cakephp cakephp 2.6.11

cakephp cakephp 2.6.10

cakephp cakephp 2.6.3

cakephp cakephp 2.6.2

cakephp cakephp 2.6.1

cakephp cakephp 2.5.6

cakephp cakephp 2.5.5

cakephp cakephp 2.4.3

cakephp cakephp 2.4.2

cakephp cakephp 2.3.9

cakephp cakephp 2.3.8

cakephp cakephp 2.3.1

cakephp cakephp 2.2.5

cakephp cakephp 2.2.4

cakephp cakephp 2.1.5

cakephp cakephp 3.1.4

cakephp cakephp 3.0.15

cakephp cakephp 3.0.14

cakephp cakephp 3.0.7

cakephp cakephp 3.0.6

cakephp cakephp 2.8.0

cakephp cakephp 2.7.3

cakephp cakephp 2.7.2

cakephp cakephp 2.6.9

cakephp cakephp 2.6.8

cakephp cakephp 2.5.4

cakephp cakephp 2.5.3

cakephp cakephp 2.4.10

cakephp cakephp 2.4.9

cakephp cakephp 2.4.1

cakephp cakephp 2.3.7

cakephp cakephp 2.3.6

cakephp cakephp 2.2.3

cakephp cakephp 2.2.2

cakephp cakephp 2.1.4

cakephp cakephp 2.1.3

cakephp cakephp 2.0.6

cakephp cakephp 2.0.5

cakephp cakephp 2.0.4

Vendor Advisories

Debian Bug report logs - #832283 cakephp: XML class SSRF vulnerability Package: src:cakephp; Maintainer for src:cakephp is Dmitry Smirnov <onlyjob@debianorg>; Reported by: balint@balintreczeyhu Date: Sat, 23 Jul 2016 18:57:02 UTC Severity: serious Tags: fixed-upstream, security, upstream Found in version cakephp/132-1 ...
Debian Bug report logs - #832316 cakephp: CVE-2015-8379 Package: src:cakephp; Maintainer for src:cakephp is Dmitry Smirnov <onlyjob@debianorg>; Reported by: balint@balintreczeyhu Date: Sat, 23 Jul 2016 18:57:02 UTC Severity: serious Tags: fixed-upstream, security, upstream Found in version cakephp/1315-1 Fixed in vers ...

Exploits

CakePHP versions 320 and below suffer from a _method cross site request forgery protection bypass vulnerability ...