See how cakephp compares to other vendors in security performance
Impact
The Cake\Database\Query::limit() and Cake\Database\Query::offset() methods are vulnerable to SQL injection if passed un-sanitized user request data.
Patches This issue has been fixed in 4.2.12, 4.3.11, 4.4.10
Workarounds
Using CakePHP's Pagination library will mitigate this issue, as will validating or casting parameters to these methods.
References
https://bakery.cakephp.org/2023/01/06/cakephp421143114410released.html
Impact The FunctionsBuilder::jsonValue($field, $jsonPath) methods with the Postgres driver is vulnerable to SQL injection if user controlled data is supplied to the $jsonPath parameter.
Patches 5.1.10, 5.2.15, 5.3.7
Workarounds Don't provide user controlled data to these functions/parameters.
Impact The FunctionsBuilder::cast($field, $dataType), extract($part, $expr), datePart($part, $expr), dateAdd($expr, $value, $unit) methods are vulnerable to SQL injection if user controlled data is supplied to the ($dataType / $part / $unit) parameters.
Patches 5.3.7, 5.2.14, 5.1.9, 4.6.5, 4.5.12 contain fixes
Workarounds Don't provide user controlled data to these functions/parameters.
CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Versions before 2.11.2, from 3.0.0 through 3.3.6, and from 4.0.0 through 4.2.0 allow authentication bypass and potential CPU or memory exhaustion when CookieAuthenticator uses unencrypted, forgeable legacy tokens. This issue is fixed in versions 2.11.2, 3.3.7, and 4.2.1.
CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the method parameter.
A vulnerability exists in CakePHP versions 4.0.x through 4.1.3. The CsrfProtectionMiddleware component allows method override parameters to bypass CSRF checks by changing the HTTP request method to an arbitrary string that is not in the list of request methods that CakePHP checks. Additionally, the route middleware does not verify that this overriden method (which can be an arbitrary string) is actually an HTTP method.
Impact
Custom mail headers added with Message::setHeaders() or addHeaders() do not have CRLF replaced allowing header injection if user controlled data is added to message headers without stripping CRLF bytes.
Patches 5.3.7, 5.2.14, 5.1.9, 4.6.5, 4.5.12 contain fixes for this issue.
Workarounds You can strip CRLF bytes from email header values before setting header values.
An issue was discovered in SmtpTransport in CakePHP 3.7.6. An unserialized object with modified internal properties can trigger arbitrary file overwriting upon destruction.
CakePHP allows remote attackers to modify internal Cake cache and execute arbitrary code
CakePHP allows remote attackers to spoof their IP
Cross-site scripting (XSS) vulnerability in cake/libs/error.php in CakePHP before 1.1.7.3363 allows remote attackers to inject arbitrary web script or HTML via the URL, which is reflected back in a 404 ("Not Found") error page. NOTE: some of these details are obtained from third party information.
Impact The PaginatorHelper::limitControl() method has a cross-site-scripting vulnerability via query string parameter manipulation.
Patches This issue has been fixed in 5.2.12 and 5.3.1
Workarounds If you are unable to upgrade, you should avoid using Paginator::limitControl() until you can upgrade.
Impact The getLoginRedirect() method contains a weakness to backslash bypasses allowing redirect targets with attacker controlled hostnames.
Patches 2.11.1, 3.3.6 and 4.1.1 contain a fix for this issue.
Workarounds If you are unable to upgrade, you should consider adding application validation to the redirect query string parameter to mitigate this vulnerability.
CakePHP directory traversal vulnerability allows remote attackers to read arbitrary files
CakePHP 1.3.7 allows remote attackers to obtain sensitive information via a direct request to a .php file
End of life: 6/15/2021, End of support: 12/15/2020, Latest version: 2.10.24
End of life: 6/15/2021, End of support: 12/15/2020, Latest version: 2.10.24
End of support: 12/21/2020, Latest version: 4.1.7
End of support: 12/21/2020, Latest version: 4.1.7
End of support: 12/9/2018, Latest version: 3.6.15
End of support: 12/9/2018, Latest version: 3.6.15
End of support: 8/13/2016, Latest version: 3.2.14
End of support: 8/13/2016, Latest version: 3.2.14
Latest version: 2.5.9
Latest version: 2.5.9
End of support: 6/20/2021, Latest version: 3.9.10
End of support: 6/20/2021, Latest version: 3.9.10
End of support: 8/19/2017, Latest version: 3.4.14
End of support: 8/19/2017, Latest version: 3.4.14
End of support: 2/13/2017, Latest version: 3.3.16