CakePHP allows remote attackers to spoof their IP · CVE-2016-4793 · GitHub Advisory Database · GitHub

CakePHP allows remote attackers to spoof their IP

High severity GitHub Reviewed Published May 14, 2022 to the GitHub Advisory Database • Updated Apr 28, 2023

Package

cakephp/cakephp (Composer)

Affected versions

>= 1.2.0, < 2.6.13

>= 2.7.0-rc1, < 2.7.11

>= 2.8.0-rc1, < 2.8.2

>= 3.0.0-rc1, < 3.0.17

>= 3.1.0-beta1, < 3.1.12

>= 3.2.0-rc1, < 3.2.5

Patched versions

2.6.13

2.7.11

2.8.2

3.0.17

3.1.12

3.2.5

Description

The clientIp function in CakePHP 3.2.4 and earlier allows remote attackers to spoof their IP via the CLIENT-IP HTTP header.

References

Published by the National Vulnerability Database

Jan 23, 2017

Published to the GitHub Advisory Database May 14, 2022

Reviewed Jan 14, 2023

Last updated Apr 28, 2023

Severity

High

7.5

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N