[MEDIUM] Direct access of prefixed controller actions

PKSA-rxqv-21q6-c8p8 GHSA-j9q2-f9q7-jhgq

Affected package: cakephp/cakephp

Affected version: >=2.0.0,<2.0.99|>=2.1.0,<2.1.99|>=2.2.0,<2.2.99|>=2.3.0,<2.3.99|>=2.4.0,<2.4.99|>=2.5.0,<2.5.9|>=2.6.0,<2.6.11|>=2.7.0,<2.7.2

Reported by:
FriendsOfPHP/security-advisories, GitHub