MGASA-2016-0044
Updated cakephp package fixes security vulnerability
CakePHP, an open-source web application framework for PHP, was vulnerable to SSRF (Server Side Request Forgery) attacks. Remote attacker can utilize it for at least DoS (Denial of Service) attacks, if the target application accepts XML as an input. It is caused by insecure design of Cake's Xml class.
What each source reports
OSV No score
Updated cakephp package fixes security vulnerability
CakePHP, an open-source web application framework for PHP, was vulnerable to SSRF (Server Side Request Forgery) attacks. Remote attacker can utilize it for at least DoS (Denial of Service) attacks, if the target application accepts XML as an input. It is caused by insecure design of Cake's Xml class.
- Record
MGASA-2016-0044- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cakephpMageia:5 |
before 1.3.21-2.mga5 | 1.3.21-2.mga5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
MGASA-2016-0044 is a vulnerability with no CVSS score yet in cakephp, published February 5, 2016. No source lists public exploit code. Fixed in cakephp 1.3.21-2.mga5.