CVE-2015-8379
CakePHP might allow remote attackers to bypass CSRF protection mechanism via the _method parameter
CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the _method parameter.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the _method parameter.
- Record
CVE-2015-8379- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-352
- Updated
- 2026-11-02
CVE List No score
CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the _method parameter.
- Record
CVE-2015-8379- Updated
- 2026-11-02
EUVDEUVD-2022-2499 No score
CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the _method parameter.
- Record
EUVD-2022-2499- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-556q-h4vr-pgh2
CakePHP might allow remote attackers to bypass CSRF protection mechanism via the _method parameter
CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the _method parameter.
- Record
GHSA-556q-h4vr-pgh2- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-352
- Updated
- 2026-11-02
OSV
CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the _method parameter.
- Record
CVE-2015-8379- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-8379
CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the _method parameter.
- Record
DEBIAN-CVE-2015-8379- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-556q-h4vr-pgh2
CakePHP might allow remote attackers to bypass CSRF protection mechanism via the _method parameter
CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the _method parameter.
- Record
GHSA-556q-h4vr-pgh2- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-352
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-8379
CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the _method parameter.
- Record
UBUNTU-CVE-2015-8379- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1769647966 No score
TuxCare security update for cakephp/cakephp (2 CVEs)
TuxCare rebuilt cakephp/cakephp to address 2 CVEs. Fixed in 2.10.24-p1+tuxcare.
- Record
CLSA-2026-1769647966- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cakephp/cakephpPackagist |
2.0.0-alpha up to 3.1.5 | 3.1.5 |
cakephp/cakephpTuxCare:Packagist From an advisory covering 2 CVEs |
2.10.24 up to 2.10.24-p1+tuxcare | 2.10.24-p1+tuxcare |
cakephpDebian:11 |
before 2.8.0-1 | 2.8.0-1 |
cakephp/cakephpPackagist |
2.0.0-alpha up to 3.1.5, plus listed versions 2.10.02.10.0-RC12.10.12.10.102.10.11 Show 45 moreShow less2.10.122.10.132.10.142.10.152.10.162.10.172.10.182.10.192.10.22.10.202.10.212.10.222.10.232.10.242.10.32.10.42.10.52.10.62.10.72.10.82.10.92.4.102.4.52.4.62.4.72.4.82.4.92.5.02.5.0-RC12.5.0-RC22.5.0-beta2.5.12.5.22.5.32.5.42.5.52.5.62.5.72.5.82.5.92.6.02.6.0-RC12.6.0-beta2.6.12.6.10 |
3.1.5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-8379 is a high vulnerability (CVSS 8.8) in Cakephp, published January 26, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.40%, the 72nd percentile. Fixed in cakephp/cakephp 3.1.5.
References
packetstormsecurity.com/files/135301/CakePHP-3.2.0-CSRF-Bypass.html
blog.mindedsecurity.com/2016/01/request-parameter-method-may-lead-to.html
securityfocus.com/archive/1/537317/100/0/threaded
karmainsecurity.com/KIS-2016-01
bakery.cakephp.org/2015/11/29/cakephp_315_released.html
seclists.org/fulldisclosure/2016/Jan/42
Show 8 moreShow less
github.com/cakephp/cakephp/commit/0f818a23a876c01429196bf7623e1e94a50230f0
nvd.nist.gov/vuln/detail/CVE-2015-8379
security-tracker.debian.org/tracker/CVE-2015-8379
ubuntu.com/security/CVE-2015-8379
cve.org/CVERecord?id=CVE-2015-8379
Left out here: 81 versions. The JSON record has them.