CVE-2020-35239 Details
Description
A vulnerability exists in CakePHP versions 4.0.x through 4.1.3. The CsrfProtectionMiddleware component allows method override parameters to bypass CSRF checks by changing the HTTP request method to an arbitrary string that is not in the list of request methods that CakePHP checks. Additionally, the route middleware does not verify that this overriden method (which can be an arbitrary string) is actually an HTTP method.
A vulnerability exists in CakePHP versions 4.0.x prior to 4.0.10 and 4.1.x through 4.1.3. The issue arises in the CsrfProtectionMiddleware component, where method override parameters can bypass CSRF protections. This is achieved by altering the HTTP request method to an arbitrary string not recognized by CakePHP's validation. Furthermore, the route middleware fails to ensure that the overridden method is a legitimate HTTP method.
Users can upgrade to CakePHP 4.0.10 or any version after 4.1.3 to address this vulnerability. Instructions for upgrading can be found in the CakePHP documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://bakery.cakephp.org/2020/12/07/cakephp_4010_released.html | CVE | Vendor Advisory |
| https://bakery.cakephp.org/2020/12/07/cakephp_4010_released.html | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| cakephp cakephp | >= 4.0.0, <= 4.1.3 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jan 15, 2025 | CPE Deprecation Remap | [email protected] |
| Nov 21, 2024 | CVE Modified | CVE |
| May 14, 2024 | CVE Modified | [email protected] |
| Feb 2, 2021 | Initial Analysis | [email protected] |