GitHub Advisoryadvisory · Packagist
GHSA-8gfq-c54m-3rf6 Yii Framework reflected Cross-site Scripting
HIGH
Official page ↗
- Aliases
- CVE-2018-6010
- Ecosystem
- Packagist
- Packages
- yiisoft/yii2
- Severity
- High
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-79
- Reviewed
- 2024-04-24
Affected packages
• Packagist yiisoft/yii2: >= 2.0.0, < 2.0.14 → fixed in 2.0.14
Description
In Yii Framework 2.x before 2.0.14, remote attackers could obtain potentially sensitive information from exception messages, or exploit reflected XSS on the error handler page in non-debug mode. Related to base/ErrorHandler.php, log/Dispatcher.php, and views/errorHandler/exception.php.
Related
Alias · CVE (1)
- CVE-2018-6010 In Yii Framework 2.x before 2.0.14, remote attackers could obtain potentially sensitive information from exception messages, or exploit… vulnerability
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2018-6010 advisory
- https://github.com/yiisoft/yii2/issues/14711 web
- https://github.com/yiisoft/yii2/pull/15534 web
- https://github.com/yiisoft/yii2/commit/6b0be47e0fa9c532e03b07b4369050582fcf5c7a web
- https://github.com/FriendsOfPHP/security-advisories/blob/master/yiisoft/yii2/CVE-2018-6010.yaml web
- https://github.com/yiisoft/yii2-framework package
- https://www.yiiframework.com/news/165/yii-2-0-14-is-released web