CVE-2020-35239 - CVE House
Back to Database
Status published High CVE-2020-35239

A vulnerability exists in CakePHP versions 4.0.x through 4.1.3. The...

Vulnerability Description

A vulnerability exists in CakePHP versions 4.0.x through 4.1.3. The CsrfProtectionMiddleware component allows method override parameters to bypass CSRF checks by changing the HTTP request method to an arbitrary string that is not in the list of request methods that CakePHP checks. Additionally, the route middleware does not verify that this overriden method (which can be an arbitrary string) is actually an HTTP method.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-35239

Credits & Attribution

No credits recorded in the NVD database.

References

More from cakephp

View All →
CVE-2023-22727
Database Query::offset() and limit() vulnerable to SQL injection in cakephp
Critical 9.8
CVE-2019-11458
An issue was discovered in SmtpTransport in CakePHP 3.7.6. An...
High 7.5
CVE-2016-4793
The clientIp function in CakePHP 3.2.4 and earlier allows remote...
High 7.5
CVE-2015-8379
CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers...
High 8.8
CVE-2011-3712
CakePHP 1.3.7 allows remote attackers to obtain sensitive information via...
Medium 5

Affected Vendor

Affected Software

cakephp
Vulnerable Versions:
4.0.0

Timeline

Official Publish: January 20th, 2021
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.