PT-2017-8529

CVE-2016-4793

Published

2017-01-23

Updated

2026-11-03

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions CakePHP versions 3.2.4 and earlier

Description The issue allows remote attackers to spoof their IP via the CLIENT-IP HTTP header. This is due to a problem in the clientIp function.

Recommendations For versions 3.2.4 and earlier, consider disabling the clientIp function until a patch is available. Restrict access to the CLIENT-IP HTTP header to minimize the risk of IP spoofing.

Exploitability

Exploit

Fix

Impacts

Researchers

Dawid Golunski

Vendors

Affected products

Weakness enumeration

CWE-20: Improper Input Validation

Related identifiers

CVE-2016-4793