Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:composer/cakephp/database@4.2.12
Typecomposer
Namespacecakephp
Namedatabase
Version4.2.12
Qualifiers
Subpath
Is_vulnerablefalse
Next_non_vulnerable_version4.3.11
Latest_non_vulnerable_version4.4.10
Affected_by_vulnerabilities
Fixing_vulnerabilities
0
url VCID-1fx6-mtxf-67an
vulnerability_id VCID-1fx6-mtxf-67an
summary 
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CakePHP is a development framework for PHP web apps. In affected versions the `Cake\Database\Query::limit()` and `Cake\Database\Query::offset()` methods is vulnerable to SQL injection if passed un-sanitized user request data. This issue has been fixed in 4.2.12, 4.3.11, 4.4.10. Users are advised to upgrade. Users unable to upgrade may mitigate this issue by using CakePHP's Pagination library. Manually validating or casting parameters to these methods will also mitigate the issue.
references
0
reference_url https://bakery.cakephp.org/2023/01/06/cakephp_4211_4311_4410_released.html
reference_id
reference_type
scores
url https://bakery.cakephp.org/2023/01/06/cakephp_4211_4311_4410_released.html
1
reference_url https://github.com/cakephp/cakephp/commit/3f463e7084b5a15e67205ced3a622577cca7a239
reference_id
reference_type
scores
url https://github.com/cakephp/cakephp/commit/3f463e7084b5a15e67205ced3a622577cca7a239
2
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-22727
reference_id CVE-2023-22727
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2023-22727
3
reference_url https://github.com/advisories/GHSA-6g8q-qfpv-57wp
reference_id GHSA-6g8q-qfpv-57wp
reference_type
scores
url https://github.com/advisories/GHSA-6g8q-qfpv-57wp
4
reference_url https://github.com/cakephp/cakephp/security/advisories/GHSA-6g8q-qfpv-57wp
reference_id GHSA-6g8q-qfpv-57wp
reference_type
scores
url https://github.com/cakephp/cakephp/security/advisories/GHSA-6g8q-qfpv-57wp
fixed_packages
0
url pkg:composer/cakephp/database@4.2.12
purl pkg:composer/cakephp/database@4.2.12
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/cakephp/database@4.2.12
1
url pkg:composer/cakephp/database@4.3.11
purl pkg:composer/cakephp/database@4.3.11
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/cakephp/database@4.3.11
2
url pkg:composer/cakephp/database@4.4.10
purl pkg:composer/cakephp/database@4.4.10
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/cakephp/database@4.4.10
aliases CVE-2023-22727, GHSA-6g8q-qfpv-57wp
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-1fx6-mtxf-67an
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:composer/cakephp/database@4.2.12