GitHub Advisoryadvisory · Packagist

GHSA-4xh9-5vh8-3p58 Yii Framework Reflected XSS

MEDIUM Published 2022-05-17 Modified 2023-10-31 Official page ↗
Aliases
CVE-2017-7271
Ecosystem
Packagist
Packages
yiisoft/yii2
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2023-07-27

Affected packages

• Packagist yiisoft/yii2: < 2.0.11 → fixed in 2.0.11

Description

Reflected Cross-site scripting (XSS) vulnerability in Yii Framework before 2.0.11, when development mode is used, allows remote attackers to inject arbitrary web script or HTML via crafted request data that is mishandled on the debug-mode exception screen.

Related

Alias · CVE (1)

  • CVE-2017-7271 Reflected Cross-site scripting (XSS) vulnerability in Yii Framework before 2.0.11, when development mode is used, allows remote attackers… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References