GitHub Advisoryadvisory · Packagist

GHSA-3mpg-q26j-83j5 Command injection in yiisoft/yii2-gii

HIGH Published 2023-01-21 Modified 2025-04-02 Official page ↗
Aliases
CVE-2020-36655
Ecosystem
Packagist
Packages
yiisoft/yii2-gii
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-94
Reviewed
2023-01-23

Affected packages

• Packagist yiisoft/yii2-gii: < 2.2.2 → fixed in 2.2.2

Description

Yii Yii2 Gii before 2.2.2 allows remote attackers to execute arbitrary code via the Generator.php messageCategory field. The attacker can embed arbitrary PHP code into the model file.

Related

Alias · CVE (1)

  • CVE-2020-36655 Yii Yii2 Gii before 2.2.2 allows remote attackers to execute arbitrary code via the Generator.php messageCategory field. vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References