CVE-2020-35239: Cross-Site Request Forgery (CSRF)

January 26, 2021 (updated February 2, 2021)

A vulnerability exists in CakePHP The CsrfProtectionMiddleware component allows method override parameters to bypass CSRF checks by changing the HTTP request method to an arbitrary string that is not in the list of request methods that CakePHP checks. Additionally, the route middleware does not verify that this overriden method (which can be an arbitrary string) is actually an HTTP method.

References

bakery.cakephp.org/2020/12/07/cakephp_4010_released.html
nvd.nist.gov/vuln/detail/CVE-2020-35239

Code Behaviors & Features

Detect and mitigate CVE-2020-35239 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →