{"id":"GHSA-829q-v5g8-hhxc","aliases":[],"status":"published","title":"CakePHP has incorrect Cross-Site Request Forgery validation","description":"CsrfComponent fails to invalidate requests that are missing both the CSRF token, and CSRF post data.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-352"],"published":"2023-01-20T23:02:02Z","modified":"2024-11-29T05:49:50Z","fixes":[{"ecosystem":"Packagist","package":"cakephp/cakephp","fixed_in":["3.0.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"cakephp/cakephp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.4"}]}]},{"source":"osv","ecosystem":"Packagist","package":"cakephp/cakephp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.4"}]}],"versions":["3.0.0","3.0.1","3.0.2","3.0.3"]}],"references":[{"url":"https://github.com/cakephp/cakephp/commit/522ed2f1fb49b00001c1ef8815a6feda790d61dd","tags":["web"]},{"url":"https://bakery.cakephp.org/2015/05/07/cakephp_3_0_4_released.html","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/cakephp/cakephp/2015-05-07.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-829q-v5g8-hhxc"},{"url":"https://github.com/cakephp/cakephp","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-829q-v5g8-hhxc","title":"CakePHP has incorrect Cross-Site Request Forgery validation","description":"CsrfComponent fails to invalidate requests that are missing both the CSRF token, and CSRF post data.","status":"published","published":"2023-01-20T23:02:02Z","modified":"2023-01-20T23:02:03Z","cwes":["CWE-352"],"updated_at":"2026-11-02T14:36:14.033357Z"}],"osv":[{"id":"GHSA-829q-v5g8-hhxc","title":"CakePHP has incorrect Cross-Site Request Forgery validation","description":"CsrfComponent fails to invalidate requests that are missing both the CSRF token, and CSRF post data.","status":"published","published":"2023-01-20T23:02:02Z","modified":"2024-11-29T05:49:50.887363Z","cwes":["CWE-352"],"updated_at":"2026-11-02T15:46:41.732368Z"}]}}