UBUNTU-CVE-2016-4793: High severity ubuntu/cakephp vulnerability
The clientIp function in CakePHP 3.2.4 and earlier allows remote attackers to spoof their IP via the CLIENT-IP HTTP header.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/cakephpto a version that resolves this vulnerability.Fixed in 1.3.15-1+deb7u2build0.14.04.1 - Upgrade
Upgrade
ubuntu/cakephpto a version that resolves this vulnerability.Fixed in 2.8.0-1ubuntu0.1~esm1
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker only needs to send an HTTP request containing a forged CLIENT-IP header. No authentication or user interaction is required.
Who is exposed to this vulnerability?
CakePHP deployments using the affected clientIp function in version 3.2.4 or earlier are exposed if application logic relies on that function to identify a client's IP address.
What is the practical impact of a spoofed client IP address?
The issue can undermine controls that trust the reported client IP, such as IP-based access decisions, allowlists, audit logging, or rate-limiting logic.