What is GHSA-4c64-w8fg-xcq2?

GHSA-4c64-w8fg-xcq2 is a security advisory published by GitHub Security Advisories with Medium severity. Yii Cross-site Scripting Framework vulnerability

Which CVE IDs does GHSA-4c64-w8fg-xcq2 cover?

GHSA-4c64-w8fg-xcq2 covers the following CVE IDs: CVE-2017-11516. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-4c64-w8fg-xcq2?

GHSA-4c64-w8fg-xcq2 has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-4c64-w8fg-xcq2?

GHSA-4c64-w8fg-xcq2 affects 2 products, including: composer/yiisoft/yii2-dev:= 2.0.12; composer/yiisoft/yii2:= 2.0.12.

GHSA-4c64-w8fg-xcq2MediumCVSS 6.1

Yii Cross-site Scripting Framework vulnerability

Vendor

GitHub Security Advisories

Published

May 17, 2022

Last Modified

April 24, 2024

🔗 CVE IDs covered (1)

CVE-2017-11516 →

📋 Description

An XSS vulnerability exists in framework/views/errorHandler/exception.php in Yii Framework 2.0.12 affecting the exception screen when debug mode is enabled, because $exception->errorInfo is mishandled.

🎯 Affected products2

composer/yiisoft/yii2-dev:= 2.0.12
composer/yiisoft/yii2:= 2.0.12

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2017-11516
https://github.com/yiisoft/yii2/pull/14492
https://github.com/yiisoft/yii2/pull/14492/files/feb4067de8a58f391a66e395192b0d83a8109b95
https://github.com/advisories/GHSA-4c64-w8fg-xcq2