2016-01-26 19:00:00
mitre
PUBLISHED
CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the _method parameter.