GitHub Advisoryadvisory · Packagist

GHSA-x87m-36g7-6mpw Yii2 Gii Cross-site Scripting vulnerability

MEDIUM Published 2022-12-10 Modified 2025-04-23 Official page ↗
Aliases
CVE-2022-34297
Ecosystem
Packagist
Packages
yiisoft/yii2-gii
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2022-12-13

Affected packages

• Packagist yiisoft/yii2-gii: <= 2.2.4 (no fix yet)

Description

Some fields like Message Category (requires I18N enabled) in Model Generator, CRUD Generator or Form Generator, Author Name in Extension Generator, etc. are being cached without sanitisation of their contents when the Preview button is pressed. This leads to possibility of injecting malicious javascript in specified pages by placing it in said fields and caching it by pressing Preview button. On each consequent visit of specified pages malicious javascript will be loaded from server and executed in client's browser.

Related

Alias · CVE (1)

  • CVE-2022-34297 Yii Yii2 Gii through 2.2.4 allows stored XSS by injecting a payload into any field. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References