CVE-2015-8379

high-risk

Published 2016-01-26

CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the _method parameter.

Do I need to act?

0.06% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 8.8/10 High

NETWORK / LOW complexity

Cakephp

Cakephp

Vendor Advisory http://bakery.cakephp.org/2015/11/29/cakephp_315_released.html

Exploit http://blog.mindedsecurity.com/2016/01/request-parameter-method-may-lead-to.html

Exploit http://karmainsecurity.com/KIS-2016-01

Exploit http://packetstormsecurity.com/files/135301/CakePHP-3.2.0-CSRF-Bypass.html

Exploit http://seclists.org/fulldisclosure/2016/Jan/42

Patch https://github.com/cakephp/cakephp/commit/0f818a23a876c01429196bf7623e1e94a50230...

Vendor Advisory http://bakery.cakephp.org/2015/11/29/cakephp_315_released.html

Exploit http://blog.mindedsecurity.com/2016/01/request-parameter-method-may-lead-to.html

Exploit http://karmainsecurity.com/KIS-2016-01

Exploit http://packetstormsecurity.com/files/135301/CakePHP-3.2.0-CSRF-Bypass.html

Exploit http://seclists.org/fulldisclosure/2016/Jan/42

Patch https://github.com/cakephp/cakephp/commit/0f818a23a876c01429196bf7623e1e94a50230...

/ 100

high-risk

Severity 30/34 · Critical

Exploitability 0/34 · Minimal

Exposure 32/34 · Critical