CVE-2017-11516 Yii Cross-site Scripting Framework vulnerability
MediumCVSS 6.1
EPSS 0.83%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An XSS vulnerability exists in framework/views/errorHandler/exception.php in Yii Framework 2.0.12 affecting the exception screen when debug mode is enabled, because $exception->errorInfo is mishandled.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| yiisoft/yii2-dev(Packagist) | >= 2.0.12, < 2.0.13 | 2.0.13 |
| yiisoft/yii2-dev(Packagist) | = 2.0.12 | No fix listed |
| yiisoft/yii2-dev(Packagist) | = 2.0.12.1 | No fix listed |
| yiisoft/yii2-dev(Packagist) | = 2.0.12.2 | No fix listed |
| yiisoft/yii2(Packagist) | >= 2.0.12, < 2.0.13 | 2.0.13 |
| yiisoft/yii2(Packagist) | = 2.0.12 | No fix listed |
| yiisoft/yii2(Packagist) | = 2.0.12.1 | No fix listed |
| yiisoft/yii2(Packagist) | = 2.0.12.2 | No fix listed |
| yiiframework yii | = 2.0.12 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com issue-tracking patch third-party-advisory
- github.com issue-tracking patch third-party-advisory
- github.com product
- github.com