CVE-2015-8379 CakePHP might allow remote attackers to bypass CSRF protection mechanism via the _method parameter
Remote attackers can bypass CSRF protection in CakePHP via the _method parameter, potentially allowing unauthorized state-changing requests.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2015-8379?
CVE-2015-8379 is a high-severity vulnerability in n/a, published on 26 Jan 2016. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the _method parameter.
Weakness: CWE-352
Which versions are affected by CVE-2015-8379?
2 open source packages ship an affected version, including cakephp/cakephp. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
cakephp/cakephp Packagist | From 2.0.0-alpha | 3.1.5 |
cakephp/cakephp Packagist | From 2.0.0-alpha | 3.1.5 |
Products include Cakephp Cakephp.
How do I fix CVE-2015-8379?
Upgrade cakephp/cakephp to 3.1.5 or later.
Is CVE-2015-8379 being exploited?
There is no known exploitation of CVE-2015-8379 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2023-22727 Database Query::offset() and limit() vulnerable to SQL injection in cakephp
- CVE-2020-35239 CakePHP allows method override parameters to bypass CSRF checks
- CVE-2019-11458 Unsafe deserialization in SmtpTransport in CakePHP
- CVE-2016-4793 CakePHP allows remote attackers to spoof their IP
- CVE-2026-23643 CakePHP PaginatorHelper::limitControl() vulnerable to reflected cross-site-scripting
Sources
Also known as DEBIAN-CVE-2015-8379, GHSA-556q-h4vr-pgh2.