PT-2017-8529

CVE-2016-4793

Publicado

2017-01-23

Atualizado

2022-05-14

Descrição por

CVSS 3.1

7.5

Alta

MétricasAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions CakePHP versions 3.2.4 and earlier

Description The issue allows remote attackers to spoof their IP via the CLIENT-IP HTTP header. This is due to a problem in the clientIp function.

Recommendations For versions 3.2.4 and earlier, consider disabling the clientIp function until a patch is available. Restrict access to the CLIENT-IP HTTP header to minimize the risk of IP spoofing.

Explorabilidade

Exploit

Correção

Impactos

Pesquisadores

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-20: Improper Input Validation

Identificadores relacionados

CVE-2016-4793

GHSA-J8P3-8M69-2HQQ