CVE-2020-35239

CVE-2020-35239 affects CakePHP 4.0.x–4.1.3. The CsrfProtectionMiddleware allows method override parameters to bypass CSRF checks by changing the HTTP method to an arbitrary string not in the allowed list, and the route middleware does not verify that this overridden method is an actual HTTP metho...