GHSA-j9q2-f9q7-jhgq
CakePHP SecurityComponent cross form submission issue
GHSA-j9q2-f9q7-jhgq is a vulnerability with no CVSS score yet in cakephp/cakephp, published January 20, 2023. No source lists public exploit code. Fixed in cakephp/cakephp 2.4.8.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.4.8cakephp/cakephp +2 more
Description
Prior to versions 2.4.8 and 1.3.18, forms secured by SecurityComponent could be submitted to any action without triggering SecurityComponent’s tampering protection. If an application contained multiple POST forms to manipulate the same models, it could be vulnerable to mass assignment issues.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cakephp/cakephpPackagist | 2.0.0 up to 2.4.8 | 2.4.8 |
cakephp/cakephpPackagist | 1.3.0 up to 1.3.18 | 1.3.18 |
cakephp/cakephpPackagist | 2.0.0 up to 2.4.8, plus listed versions 2.4.52.4.62.4.7 | 2.4.8 |
What each source reports
GitHub AdvisoriesNo score
CakePHP SecurityComponent cross form submission issue
Prior to versions 2.4.8 and 1.3.18, forms secured by SecurityComponent could be submitted to any action without triggering SecurityComponent’s tampering protection. If an application contained multiple POST forms to manipulate the same models, it could be vulnerable to mass assignment issues.
- Record
GHSA-j9q2-f9q7-jhgq- Updated
- 2026-11-02
OSVNo score
CakePHP SecurityComponent cross form submission issue
Prior to versions 2.4.8 and 1.3.18, forms secured by SecurityComponent could be submitted to any action without triggering SecurityComponent’s tampering protection. If an application contained multiple POST forms to manipulate the same models, it could be vulnerable to mass assignment issues.
- Record
GHSA-j9q2-f9q7-jhgq- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.