Description

CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the _method parameter.

Remediation

References

CVE-2015-8379

Related Vulnerabilities

WordPress Plugin UltimateWoo-The Ultimate WooCommerce with Unlimited Usage PHP Object Injection (0.1.10)

WordPress Plugin The Piecemaker 'php.php' Arbitrary File Upload (1.1)

WordPress Plugin Login Security Solution Multiple Unspecified Vulnerabilities (0.50.0)

MediaWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2024-40605)

WordPress Plugin Strong Testimonials Cross-Site Scripting (2.40.0)

Severity

High

Classification

CVE-2015-8379 CWE-352 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities