Description
Cross-site scripting (XSS) vulnerability in cake/libs/error.php in CakePHP before 1.1.7.3363 allows remote attackers to inject arbitrary web script or HTML via the URL, which is reflected back in a 404 ("Not Found") error page. NOTE: some of these details are obtained from third party information.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 11 | cakephp | 1.1.13.4450-1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | cakephp/cakephp | >= 1.0.1.2708, < 1.1.7.3363 | 1.1.7.3363 | GHSA-vc29-mvwv-wpcq |
References
- 19372 vdb-entry
- 21383 third-party-advisory
- http://cakeforge.org/frs/shownotes.php?release_id=124
- ADV-2006-3172 vdb-entry
- cakephp-error-xss(28256) vdb-entry