USN-8978-1 — cakephp vulnerability

Summary

Dawid Golunski discovered that CakePHP incorrectly trusted the CLIENT-IP
HTTP header when determining the client IP address. A remote attacker could
possibly use this issue to spoof their IP address.

Fixed packages 1

Release	Package	Fixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS	cakephp	2.8.0-1ubuntu0.1~esm1

Vulnerabilities 1

High 7.5

CVE-2016-4793 Public exploit

CakePHP allows remote attackers to spoof their IP

The clientIp function in CakePHP 3.2.4 and earlier allows remote attackers to spoof their IP via the CLIENT-IP HTTP header.

cakephp/cakephp cakephp cakephp Debian Ubuntu Packagist

Jan 23, 2017

References

report
https://ubuntu.com/security/CVE-2016-4793

cakephp vulnerability

Summary

Fixed packages 1

Vulnerabilities 1

CakePHP allows remote attackers to spoof their IP

References