CVE-2010-4335

Source
https://nvd.nist.gov/vuln/detail/CVE-2010-4335
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2010-4335.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2010-4335
Aliases
Published
2011-01-14T23:00:46Z
Modified
2024-09-11T02:00:06Z
Summary
[none]
Details

The validatePost function in libs/controller/components/security.php in CakePHP 1.3.x through 1.3.5 and 1.2.8 allows remote attackers to modify the internal Cake cache and execute arbitrary code via a crafted data[Token][fields] value that is processed by the unserialize function, as demonstrated by modifying the file_map cache to execute arbitrary local files.

References

Affected packages

Debian:11 / cakephp

Package

Name
cakephp
Purl
pkg:deb/debian/cakephp?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.3.2-1.1

Ecosystem specific

{
    "urgency": "not yet assigned"
}