MEDIUM 4.3
GHSA-p46m-g734-vpc4
cakephp/debug_kit: MailPreview contains unsafe reflection
Quick fix
GHSA-p46m-g734-vpc4 — cakephp/debug_kit: upgrade to the fixed version with the command below.
composer require cakephp/debug_kit:^4.10.3Details
### Impact
The `MailPreview` feature of debugkit is vulnerable to arbitrary constructor execution. For an application to be vulnerable the following conditions must be true:
1. `debug` mode must be enabled. 2. The hostname must match a 'local' domain or be in an allowlist.
### Patches 5.2.4 and 4.10.3 contain patches for this issue.
### Workarounds Ensure that debugkit is only part of your development dependencies, and that debug mode is disabled in production environments.
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist / cakephp/debug_kit
Introduced in:
0 Fixed in: 4.10.3 Fix
composer require cakephp/debug_kit:^4.10.3 Packagist / cakephp/debug_kit
Introduced in:
5.0.0 Fixed in: 5.2.4 Fix
composer require cakephp/debug_kit:^5.2.4 References
- https://github.com/cakephp/debug_kit/security/advisories/GHSA-p46m-g734-vpc4 [WEB]
- https://github.com/cakephp/debug_kit/pull/1078 [WEB]
- https://github.com/cakephp/debug_kit/commit/7c4d85e984c2334b0f50cd02578a927ff9649e13 [WEB]
- https://github.com/cakephp/debug_kit/commit/c8a2a9e07d56a5e212d95f6947f370f3b5e6eed6 [WEB]
- https://github.com/cakephp/debug_kit [PACKAGE]
- https://github.com/cakephp/debug_kit/releases/tag/4.10.3 [WEB]
- https://github.com/cakephp/debug_kit/releases/tag/5.2.4 [WEB]