GHSA-6hg4-vp5q-47mw
CakePHP allows direct access of prefixed controller actions
GHSA-6hg4-vp5q-47mw is a vulnerability with no CVSS score yet in cakephp/cakephp, published January 20, 2023. No source lists public exploit code. Fixed in cakephp/cakephp 2.0.99.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.0.99cakephp/cakephp +11 more
Description
Unconventional URL paths would allow direct access to prefixed actions without setting the correct request parameters.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cakephp/cakephpPackagist | 2.0.0 up to 2.0.99 | 2.0.99 |
cakephp/cakephpPackagist | 2.1.0 up to 2.1.99 | 2.1.99 |
cakephp/cakephpPackagist | 2.2.0 up to 2.2.99 | 2.2.99 |
cakephp/cakephpPackagist | 2.3.0 up to 2.3.99 | 2.3.99 |
cakephp/cakephpPackagist | 2.4.0 up to 2.4.99 | 2.4.99 |
cakephp/cakephpPackagist | 2.5.0 up to 2.5.9 | 2.5.9 |
cakephp/cakephpPackagist | 2.6.0 up to 2.6.11 | 2.6.11 |
cakephp/cakephpPackagist | 2.7.0 up to 2.7.2 | 2.7.2 |
cakephp/cakephpPackagist | 2.4.0 up to 2.4.99, plus listed versions 2.4.102.4.52.4.62.4.72.4.82.4.9 | 2.4.99 |
cakephp/cakephpPackagist | 2.5.0 up to 2.5.9, plus listed versions 2.5.12.5.22.5.32.5.42.5.52.5.62.5.72.5.8 | 2.5.9 |
cakephp/cakephpPackagist | 2.6.0 up to 2.6.11, plus listed versions 2.6.12.6.102.6.22.6.32.6.4 Show 5 moreShow less2.6.52.6.62.6.72.6.82.6.9 | 2.6.11 |
cakephp/cakephpPackagist | 2.7.0 up to 2.7.2, plus listed versions 2.7.1 | 2.7.2 |
What each source reports
GitHub AdvisoriesNo score
CakePHP allows direct access of prefixed controller actions
Unconventional URL paths would allow direct access to prefixed actions without setting the correct request parameters.
- Record
GHSA-6hg4-vp5q-47mw- Updated
- 2026-11-02
OSVNo score
CakePHP allows direct access of prefixed controller actions
Unconventional URL paths would allow direct access to prefixed actions without setting the correct request parameters.
- Record
GHSA-6hg4-vp5q-47mw- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/cakephp/cakephp/commit/056f24a77428ad35e23cab6840a72b7c25c4ccc0
bakery.cakephp.org/2015/08/06/cakephp_2_5_9_2_6_10_2_7_2_released.html