CVE-2006-4067 — Cross-site Scripting in Cakephp

CWE-79 — Cross-site Scripting5 documents4 sources
Severity
4.3MEDIUMNVD
EPSS
0.4%
top 38.28%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
CakephpDebian Cakephp
Timeline
PublishedAug 10
Latest updateMay 1

Description

Cross-site scripting (XSS) vulnerability in cake/libs/error.php in CakePHP before 1.1.7.3363 allows remote attackers to inject arbitrary web script or HTML via the URL, which is reflected back in a 404 ("Not Found") error page. NOTE: some of these details are obtained from third party information.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages4 packages

▶debiandebian/cakephp< cakephp 1.1.13.4450-1 (bullseye)
▶Packagistcakephp/cakephp1.0.1.2708 — 1.1.7.3363
▶Debiancakephp/cakephp< 1.1.13.4450-1
▶NVDcakephp/cakephp1.1.6.3264+4

Patches

Patch: cakeforge.org ↗Patch: secunia.com ↗Patch: cakeforge.org ↗

🔴Vulnerability Details

3
GHSA
Cross-site scripting (XSS) vulnerability in CakePHP↗2022-05-01
▶
OSV
Cross-site scripting (XSS) vulnerability in CakePHP↗2022-05-01
▶
OSV
CVE-2006-4067: Cross-site scripting (XSS) vulnerability in cake/libs/error↗2006-08-10
▶

📋Vendor Advisories

1
Debian
CVE-2006-4067: cakephp - Cross-site scripting (XSS) vulnerability in cake/libs/error.php in CakePHP befor...↗2006
▶