GitHub Advisoryadvisory · Packagist

GHSA-cr6r-6xm9-ww22 Yii Incorrectly Implements CORS

MEDIUM Published 2022-05-14 Modified 2023-08-28 Official page ↗
Aliases
CVE-2018-20745
Ecosystem
Packagist
Packages
yiisoft/yii2
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-346
Reviewed
2023-08-28

Affected packages

• Packagist yiisoft/yii2: < 2.0.16 → fixed in 2.0.16

Description

Yii 2.x through 2.0.15.1 actively converts a wildcard CORS policy into reflecting an arbitrary Origin header value, which is incompatible with the CORS security design, and could lead to CORS misconfiguration security problems.

Related

Alias · CVE (1)

  • CVE-2018-20745 Yii 2.x through 2.0.15.1 actively converts a wildcard CORS policy into reflecting an arbitrary Origin header value, which is incompatible… vulnerability

Weakness · CWE (1)

  • CWE-346 Origin Validation Error weakness

References