CyberRota Analysis
AI-GeneratedThe vulnerability affects the CakePHP Queue library versions 0.1.11 to 2.3.1, where the QueueManager::getUniqueId() method improperly handles job parameters, allowing an unauthenticated attacker to manipulate input and cause legitimate jobs to be erroneously identified as duplicates. This can lead to critical job failures in systems relying on unique job identifiers. Developers and organizations using affected versions of CakePHP Queue should prioritize upgrading to version 2.3.1 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
CakePHP Queue is a queue-interop compatible queueing library. From 0.1.11 until 2.3.1, QueueManager::getUniqueId() generates identifiers for jobs with shouldBeUnique enabled from the job class, method, and parameters, but sorting parameter values drops associative-array keys. An unauthenticated attacker who can influence job parameters can submit semantically different data that produces the same identifier, resulting in legitimate jobs dropped as duplicate collisions. This issue is fixed in version 2.3.1.