CVE-2020-35239

A vulnerability exists in CakePHP versions 4.0.x through 4.1.3. The CsrfProtectionMiddleware component allows method override parameters to bypass CSRF checks by changing the HTTP request method to an arbitrary string that is not in the list of request methods that CakePHP checks. Additionally, the route middleware does not verify that this overriden method (which can be an arbitrary string) is actually an HTTP method.

CVSS v3 8.8 HIGH
CVSS v2.0 6.8 MEDIUM

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://bakery.cakephp.org/2020/12/07/cakephp_4010_released.html	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:cakefoundation:cakephp:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2021-01-26 18:15

Updated : 2024-02-28 18:08

NVD link : CVE-2020-35239

Mitre link : CVE-2020-35239

CVE.ORG link : CVE-2020-35239

JSON object : View

Products Affected

cakefoundation

cakephp

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2020-35239", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2021-01-26T18:15:53.583", "references": [{"url": "https://bakery.cakephp.org/2020/12/07/cakephp_4010_released.html", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability exists in CakePHP versions 4.0.x through 4.1.3. The CsrfProtectionMiddleware component allows method override parameters to bypass CSRF checks by changing the HTTP request method to an arbitrary string that is not in the list of request methods that CakePHP checks. Additionally, the route middleware does not verify that this overriden method (which can be an arbitrary string) is actually an HTTP method."}, {"lang": "es", "value": "Se presenta una vulnerabilidad en CakePHP versiones 4.0.x hasta 4.1.3. El componente CsrfProtectionMiddleware permite que los par\u00e1metros de anulaci\u00f3n de m\u00e9todos omitan las comprobaciones CSRF mediante el cambio del m\u00e9todo de petici\u00f3n HTTP para una cadena arbitraria que no est\u00e1 en la lista de m\u00e9todos de petici\u00f3n que CakePHP comprueba. Adem\u00e1s, el middleware de ruta no verifica que este m\u00e9todo se haya anulado (que puede ser una cadena arbitraria) sea en realidad un m\u00e9todo HTTP"}], "lastModified": "2021-02-02T17:47:39.250", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cakefoundation:cakephp:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FF9651A7-BA2D-4226-8911-1160A8DCD80D", "versionEndIncluding": "4.1.3", "versionStartIncluding": "4.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}