PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-4793 Cakephp CVE debrief

CVE-2016-4793 is an IP-spoofing flaw in CakePHP’s clientIp() helper. On affected versions, a remote attacker can supply a CLIENT-IP header value that is treated as the client address, which can undermine IP-based security controls and audit data. The NVD record rates the issue HIGH with network access required but no authentication or user interaction.

Vendor
Cakephp
Product
CVE-2016-4793
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-23
Original CVE updated
2026-05-13
Advisory published
2017-01-23
Advisory updated
2026-05-13

Who should care

Teams running CakePHP applications that use clientIp() or other request-header-derived IP data for access control, allowlists, rate limiting, fraud checks, or security logging.

Technical summary

NVD identifies CakePHP versions up to and including 3.2.4 as vulnerable. The issue is described as a clientIp() function weakness that allows remote attackers to spoof their source IP through the CLIENT-IP HTTP header. NVD classifies the weakness as CWE-20 and assigns CVSS 3.0 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), indicating a network-reachable integrity impact with no privileges or user interaction required.

Defensive priority

High priority for any internet-facing CakePHP deployment that trusts request headers for client IP determination or downstream security decisions.

Recommended defensive actions

  • Upgrade CakePHP to a fixed release at or above the vendor-published patched versions referenced in the advisory (including 3.2.5 for the 3.x line).
  • Audit application code and infrastructure for any use of clientIp() or custom IP extraction logic in authentication, authorization, logging, allowlists, and rate limiting.
  • Do not trust CLIENT-IP or similar client-supplied headers unless they are added by a trusted proxy under a controlled configuration.
  • Review logs and detections that depend on client IP addresses for this vulnerability window, since recorded source IPs may be unreliable.
  • If a trusted proxy is in use, validate header handling at the proxy layer and prefer a controlled proxy header chain over direct client-provided values.

Evidence notes

The supplied NVD record lists the vulnerable CPE as cakephp:cakephp up to and including 3.2.4 and gives CVSS 3.0 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N with CWE-20. The CVE metadata includes a CakePHP release announcement reference that names fixed releases including 3.2.5, plus third-party advisory and exploit references. This debrief uses the NVD and CVE metadata only; it does not rely on exploit details.

Official resources

CVE-2016-4793 was published on 2017-01-23 and later modified on 2026-05-13. The vendor advisory reference in the CVE metadata points to a CakePHP release announcement dated 2016-03-13, indicating the fix reference available in the source-cv