7.5

CVE-2010-4335

Exploit
The _validatePost function in libs/controller/components/security.php in CakePHP 1.3.x through 1.3.5 and 1.2.8 allows remote attackers to modify the internal Cake cache and execute arbitrary code via a crafted data[_Token][fields] value that is processed by the unserialize function, as demonstrated by modifying the file_map cache to execute arbitrary local files.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cakefoundation ≫ Cakephp Version1.3.0
Cakephp ≫ Cakephp Version1.2.8
Cakephp ≫ Cakephp Version1.3 Updatedev
Cakephp ≫ Cakephp Version1.3.0 Updatealpha
Cakephp ≫ Cakephp Version1.3.0 Updatebeta
Cakephp ≫ Cakephp Version1.3.0 Updaterc1
Cakephp ≫ Cakephp Version1.3.0 Updaterc2
Cakephp ≫ Cakephp Version1.3.0 Updaterc3
Cakephp ≫ Cakephp Version1.3.0 Updaterc4
Cakephp ≫ Cakephp Version1.3.1
Cakephp ≫ Cakephp Version1.3.2
Cakephp ≫ Cakephp Version1.3.3
Cakephp ≫ Cakephp Version1.3.4
Cakephp ≫ Cakephp Version1.3.5
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 82.64% 0.992
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.