CVE-2010-4335: Input Validation
The validatePost function in libs/controller/components/security.php in CakePHP 1.3.x through 1.3.5 and 1.2.8 allows remote attackers to modify the internal Cake cache and execute arbitrary code via a crafted data[Token][fields] value that is processed by the unserialize function, as demonstrated by modifying the filemap cache to execute arbitrary local files.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2010-4335?
CVE-2010-4335 is classified as a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2010-4335?
To mitigate CVE-2010-4335, upgrade your CakePHP installation to version 1.3.6 or later.
What versions are affected by CVE-2010-4335?
CVE-2010-4335 affects CakePHP versions 1.2.8 and 1.3.0 through 1.3.5.
Can CVE-2010-4335 allow attackers to execute arbitrary code?
Yes, CVE-2010-4335 allows remote attackers to execute arbitrary code by manipulating the data processed by the unserialize function.
What component of CakePHP is vulnerable in CVE-2010-4335?
The _validatePost function in libs/controller/components/security.php is the vulnerable component in CVE-2010-4335.