CVE-2019-11458: Unsafe deserialization in SmtpTransport
An issue was discovered in SmtpTransport in CakePHP 3.7.6. An unserialized object with modified internal properties can trigger arbitrary file overwriting upon destruction.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/cakephp/cakephpto a version that resolves this vulnerability.Fixed in 3.7.7 - Upgrade
Upgrade
composer/cakephp/cakephpto a version that resolves this vulnerability.Fixed in 3.6.15 - Upgrade
Upgrade
composer/cakephp/cakephpto a version that resolves this vulnerability.Fixed in 3.5.18
Event History
Frequently Asked Questions
What is the severity of CVE-2019-11458?
CVE-2019-11458 has a high severity level due to the potential for arbitrary file overwriting.
How do I fix CVE-2019-11458?
To fix CVE-2019-11458, upgrade SmtpTransport to CakePHP version 3.7.7, 3.6.15, or 3.5.18.
What versions of CakePHP are affected by CVE-2019-11458?
CVE-2019-11458 affects CakePHP versions from 3.0.0 up to 3.7.6, including certain 3.6.x and 3.5.x versions.
What is the impact of CVE-2019-11458?
The impact of CVE-2019-11458 allows an attacker to overwrite arbitrary files through unsafe deserialization.
Is CVE-2019-11458 publicly known?
Yes, CVE-2019-11458 was publicly disclosed and documented in various security advisories.