CVE-2006-5031: CakePHP directory traversal vulnerability allows remote attackers to read arbitrary files
CakePHP directory traversal vulnerability allows remote attackers to read arbitrary files
Other sources
Directory traversal vulnerability in app/webroot/js/vendors.php in Cake Software Foundation CakePHP before 1.1.8.3544 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter, followed by a filename ending with %00 and a .js filename.
— GitHub
Directory traversal vulnerability in app/webroot/js/vendors.php in Cake Software Foundation CakePHP before 1.1.8.3544 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter, followed by a filename ending with "%00" and a .js filename.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/cakephp/cakephpto a version that resolves this vulnerability.Fixed in 1.1.8.3544
Event History
Frequently Asked Questions
What is the severity of CVE-2006-5031?
CVE-2006-5031 has a medium severity rating due to its potential to allow remote file access.
How do I fix CVE-2006-5031?
To fix CVE-2006-5031, upgrade to CakePHP version 1.1.8.3544 or later.
What effects does CVE-2006-5031 have on affected systems?
CVE-2006-5031 can allow attackers to read arbitrary files from the server, leading to information disclosure.
Which versions of CakePHP are affected by CVE-2006-5031?
CVE-2006-5031 affects CakePHP versions prior to 1.1.8.3544, specifically up to version 1.1.7.3363.
What type of vulnerability is CVE-2006-5031?
CVE-2006-5031 is a directory traversal vulnerability.