PT-2006-4911 · Cakephp · Cakephp
CVE-2006-4067
·
Publicado
2006-08-10
·
Atualizado
2025-01-15
CVSS v3.1
6.5
Média
| Vetor | AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
CakePHP versions prior to 1.1.7.3363
Description
A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the URL, which is reflected back in a 404 ("Not Found") error page. This occurs due to a vulnerability in cake/libs/error.php.
Recommendations
For versions prior to 1.1.7.3363, update to version 1.1.7.3363 or later to resolve the issue. As a temporary workaround, consider restricting access to the cake/libs/error.php file until a patch is applied.
Correção
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Cakephp