CVEvulnerability
CVE-2020-36655
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2023-01-21
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-94
Description
Yii Yii2 Gii before 2.2.2 allows remote attackers to execute arbitrary code via the Generator.php messageCategory field. The attacker can embed arbitrary PHP code into the model file.
Affected configurations
• yiiframework gii (< 2.2.2)
Related
Weakness · CWE (1)
- CWE-94 Improper Control of Generation of Code weakness
References
- https://github.com/yiisoft/yii2-gii/issues/433 Exploit, Issue Tracking, Third Party Advisory
- https://lab.wallarm.com/yii2-gii-remote-code-execution/ Exploit, Mitigation, Third Party Advisory
- https://github.com/yiisoft/yii2-gii/issues/433 Exploit, Issue Tracking, Third Party Advisory
- https://lab.wallarm.com/yii2-gii-remote-code-execution/ Exploit, Mitigation, Third Party Advisory