Description
CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the _method parameter.
Remediation
References
Related Vulnerabilities
PHP Permissions, Privileges, and Access Controls Vulnerability (CVE-2008-5624)
Joomla Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2008-5671)
WordPress Plugin TinyMCE Advanced Cross-Site Request Forgery (4.1)
MediaWiki Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2021-31545)