Debian DLA-333-1 : cakephp security update

high Nessus Plugin ID 86578

Language:

Synopsis

The remote Debian host is missing a security update.

Description

CakePHP, an open source web application framework for PHP, was vulnerable to SSRF (Server Side Request Forgery) attacks. Remote attacker can utilize it for at least DoS (Denial of Service) attacks, if the target application accepts XML as an input. It is caused by insecure design of Cake's Xml class.

For Debian 6 Squeeze, this issue has been fixed in cakephp version 1.3.2-1.1+deb6u11.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Solution

Upgrade the affected cakephp, and cakephp-scripts packages.

Plugin Details

Severity: High

ID: 86578

File Name: debian_DLA-333.nasl

Version: 2.4

Type: local

Agent: unix

Family: Debian Local Security Checks

Published: 10/26/2015

Updated: 1/11/2021

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Nessus Agent, Nessus

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:cakephp-scripts, cpe:/o:debian:debian_linux:6.0, p-cpe:/a:debian:debian_linux:cakephp

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Patch Publication Date: 10/23/2015

Detections

Analytics