« Volver al listado

CVE-2023-22727

Estado: ModificadaCrítica (9.8)—

CakePHP is a development framework for PHP web apps. In affected versions the `Cake\Database\Query::limit()` and `Cake\Database\Query::offset()` methods are vulnerable to SQL injection if passed un-sanitized user request data. This issue has been fixed in 4.2.12, 4.3.11, 4.4.10. Users are advised to upgrade. Users unable to upgrade may mitigate this issue by using CakePHP's Pagination library. Manually validating or casting parameters to these methods will also mitigate the issue.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Cakephp — Cakephp

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-22727",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-22727",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-03-10T20:59:15.575626Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "cakephp",
          "product": "cakephp",
          "versions": [
            {
              "status": "affected",
              "version": ">= 4.2.0, < 4.2.12"
            },
            {
              "status": "affected",
              "version": ">= 4.3.0, < 4.3.11"
            },
            {
              "status": "affected",
              "version": ">= 4.4.0, < 4.4.10"
            }
          ]
        }
      ]
    }
  ],
  "published": "2023-01-17T21:15:16.550",
  "references": [
    {
      "url": "https://bakery.cakephp.org/2023/01/06/cakephp_4211_4311_4410_released.html",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/cakephp/cakephp/commit/3f463e7084b5a15e67205ced3a622577cca7a239",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/cakephp/cakephp/security/advisories/GHSA-6g8q-qfpv-57wp",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://bakery.cakephp.org/2023/01/06/cakephp_4211_4311_4410_released.html",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/cakephp/cakephp/commit/3f463e7084b5a15e67205ced3a622577cca7a239",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/cakephp/cakephp/security/advisories/GHSA-6g8q-qfpv-57wp",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "CakePHP is a development framework for PHP web apps. In affected versions the `Cake\\Database\\Query::limit()` and `Cake\\Database\\Query::offset()` methods are vulnerable to SQL injection if passed un-sanitized user request data. This issue has been fixed in 4.2.12, 4.3.11, 4.4.10. Users are advised to upgrade. Users unable to upgrade may mitigate this issue by using CakePHP's Pagination library. Manually validating or casting parameters to these methods will also mitigate the issue."
    },
    {
      "lang": "es",
      "value": "CakePHP es un framework de desarrollo para aplicaciones web PHP. En las versiones afectadas, los métodos `Cake\\Database\\Query::limit()` y `Cake\\Database\\Query::offset()` son vulnerables a la inyección SQL si se pasan datos de solicitud de usuario sin desinfectar. Este problema se solucionó en 4.2.12, 4.3.11, 4.4.10. Se recomienda a los usuarios que actualicen. Los usuarios que no puedan actualizar pueden mitigar este problema utilizando la librería de paginación de CakePHP. La validación manual o la conversión de parámetros a estos métodos también mitigará el problema."
    }
  ],
  "lastModified": "2026-06-17T05:36:02.727",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cakephp:cakephp:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "54CC7CDF-D3A7-427B-B734-89E0E47778C7",
              "versionEndExcluding": "4.2.12",
              "versionStartIncluding": "4.2.0"
            },
            {
              "criteria": "cpe:2.3:a:cakephp:cakephp:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "09F4E6E5-91F9-4496-88A1-2B9DCC6D9656",
              "versionEndExcluding": "4.3.11",
              "versionStartIncluding": "4.3.0"
            },
            {
              "criteria": "cpe:2.3:a:cakephp:cakephp:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "45326B61-AA4E-4D7C-8B29-ACE4AA9951E5",
              "versionEndExcluding": "4.4.10",
              "versionStartIncluding": "4.4.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}