What is GHSA-74qv-rv53-5wcx?

GHSA-74qv-rv53-5wcx is a security advisory published by GitHub Security Advisories with High severity. Yii PHP Framework arbitrary PHP scripts execution

Which CVE IDs does GHSA-74qv-rv53-5wcx cover?

GHSA-74qv-rv53-5wcx covers the following CVE IDs: CVE-2014-4672. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-74qv-rv53-5wcx?

GHSA-74qv-rv53-5wcx affects 1 product, including: composer/yiisoft/yii:\u003e= 1.1.14, \u003c 1.1.15.

GHSA-74qv-rv53-5wcxHigh

Yii PHP Framework arbitrary PHP scripts execution

Vendor

GitHub Security Advisories

Published

May 17, 2022

Last Modified

April 24, 2024

🔗 CVE IDs covered (1)

CVE-2014-4672 →

📋 Description

The CDetailView widget in Yii PHP Framework 1.1.14 allows remote attackers to execute arbitrary PHP scripts via vectors related to the value property.

🎯 Affected products1

composer/yiisoft/yii:>= 1.1.14, < 1.1.15

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2014-4672
https://github.com/FriendsOfPHP/security-advisories/blob/master/yiisoft/yii/CVE-2014-4672.yaml
https://www.yiiframework.com/news/78/yii-1-1-15-is-released-security-fix
https://github.com/advisories/GHSA-74qv-rv53-5wcx