GitHub Advisoryadvisory · Packagist

GHSA-4c64-w8fg-xcq2 Yii Cross-site Scripting Framework vulnerability

MEDIUM Published 2022-05-17 Modified 2024-04-24 Official page ↗
Aliases
CVE-2017-11516
Ecosystem
Packagist
Packages
yiisoft/yii2-dev, yiisoft/yii2
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2024-04-24

Affected packages

• Packagist yiisoft/yii2-dev: >= 2.0.12, < 2.0.13 → fixed in 2.0.13 • Packagist yiisoft/yii2: >= 2.0.12, < 2.0.13 → fixed in 2.0.13

Description

An XSS vulnerability exists in framework/views/errorHandler/exception.php in Yii Framework 2.0.12 affecting the exception screen when debug mode is enabled, because $exception->errorInfo is mishandled.

Related

Alias · CVE (1)

  • CVE-2017-11516 An XSS vulnerability exists in framework/views/errorHandler/exception.php in Yii Framework 2.0.12 affecting the exception screen when debug… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References