CVEvulnerability
CVE-2017-7271
6.1 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2017-03-27
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 6.1 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Reflected Cross-site scripting (XSS) vulnerability in Yii Framework before 2.0.11, when development mode is used, allows remote attackers to inject arbitrary web script or HTML via crafted request data that is mishandled on the debug-mode exception screen.
Affected configurations
• yii software yii (<= 2.0.10)
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://www.securityfocus.com/bid/97167 www.securityfocus.com
- http://www.yiiframework.com/news/123/yii-2-0-11-is-released/ Release Notes, Vendor Advisory
- https://github.com/yiisoft/yii2/commit/97171a0db7cda0a49931ee0c3b998ef50bd06756 github.com
- https://github.com/yiisoft/yii2/pull/13401 github.com
- http://www.securityfocus.com/bid/97167 www.securityfocus.com
- http://www.yiiframework.com/news/123/yii-2-0-11-is-released/ Release Notes, Vendor Advisory
- https://github.com/yiisoft/yii2/commit/97171a0db7cda0a49931ee0c3b998ef50bd06756 github.com
- https://github.com/yiisoft/yii2/pull/13401 github.com