CVE-2020-15400: Cross-Site Request Forgery in CakePHP
CakePHP before 4.0.6 and 3.10.3 mishandles CSRF token generation. This might be remotely exploitable in conjunction with XSS.
Other sources
CakePHP before 4.0.6 mishandles CSRF token generation. This might be remotely exploitable in conjunction with XSS.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/cakephp/cakephpto a version that resolves this vulnerability.Fixed in 3.10.3 - Upgrade
Upgrade
composer/cakephp/cakephpto a version that resolves this vulnerability.Fixed in 4.0.6
Event History
Frequently Asked Questions
What is the severity of CVE-2020-15400?
The severity of CVE-2020-15400 is medium.
How does CVE-2020-15400 affect CakePHP?
CVE-2020-15400 affects CakePHP versions before 4.0.6 and 3.10.3.
What is the vulnerability in CVE-2020-15400?
The vulnerability in CVE-2020-15400 is mishandling of CSRF token generation in CakePHP.
Can CVE-2020-15400 be exploited remotely?
Yes, CVE-2020-15400 might be remotely exploitable in conjunction with XSS.
How can I fix CVE-2020-15400?
To fix CVE-2020-15400, update your CakePHP installation to version 4.0.6 or 3.10.3.