Vulnerability CVE-2015-3397


Published: 2015-05-13   Modified: 2015-05-14

Description:
Cross-site scripting (XSS) vulnerability in Yii Framework before 2.0.4 allows remote attackers to inject arbitrary web script or HTML via vectors related to JSON, arrays, and Internet Explorer 6 or 7.

Vendor: Yiiframework
Product: Yiiframework 
Version: 2.0.3;

CVSS2 => (AV:N/AC:M/Au:N/C:N/I:P/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
4.3/10
2.9/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
None
Partial
None

 References:
http://www.securityfocus.com/bid/74663
http://www.yiiframework.com/news/86/yii-2-0-4-is-released/
https://github.com/yiisoft/yii2/blob/2.0.4/framework/CHANGELOG.md

Related CVE
CVE-2018-6010
In Yii Framework 2.x before 2.0.14, remote attackers could obtain potentially sensitive information from exception messages printed by the error handler in non-debug mode, related to base/ErrorHandler.php, log/Dispatcher.php, and views/errorHandler/e...
CVE-2018-6009
In Yii Framework 2.x before 2.0.14, the switchIdentity function in web/User.php did not regenerate the CSRF token upon a change of identity.
CVE-2017-11516
An XSS vulnerability exists in framework/views/errorHandler/exception.php in Yii Framework 2.0.12 affecting the exception screen when debug mode is enabled, because $exception->errorInfo is mishandled.
CVE-2014-4672
The CDetailView widget in Yii PHP Framework before 1.1.15 allows remote attackers to execute arbitrary PHP scripts via vectors related to the value property.

Copyright 2019, cxsecurity.com

 

Back to Top