Skip to content

CVE-2018-6009 Yii Framework Cross-Site Request Forgery (CSRF)

HighCVSS 8.8 EPSS 0.60% PoC
Published
Updated
Exploit status
Proof-of-concept only
Sign in for asset impact Search another CVE

Description

In Yii Framework 2.x before 2.0.14, the switchIdentity function in web/User.php did not regenerate the CSRF token upon a change of identity.

Affected products

ProductAffected versionsFixed in
yiisoft/yii2(Packagist) >= 2.0, < 2.0.14 2.0.14
yiisoft/yii2(Packagist) = 2.0.0 No fix listed
yiisoft/yii2(Packagist) = 2.0.0-alpha No fix listed
yiisoft/yii2(Packagist) = 2.0.0-beta No fix listed
yiisoft/yii2(Packagist) = 2.0.0-rc No fix listed
yiisoft/yii2(Packagist) = 2.0.1 No fix listed
yiisoft/yii2(Packagist) = 2.0.10 No fix listed
yiisoft/yii2(Packagist) = 2.0.11 No fix listed
yiisoft/yii2(Packagist) = 2.0.11.1 No fix listed
yiisoft/yii2(Packagist) = 2.0.11.2 No fix listed
yiisoft/yii2(Packagist) = 2.0.12 No fix listed
yiisoft/yii2(Packagist) = 2.0.12.1 No fix listed
yiisoft/yii2(Packagist) = 2.0.12.2 No fix listed
yiisoft/yii2(Packagist) = 2.0.13 No fix listed
yiisoft/yii2(Packagist) = 2.0.13.1 No fix listed
yiisoft/yii2(Packagist) = 2.0.13.2 No fix listed
yiisoft/yii2(Packagist) = 2.0.13.3 No fix listed
yiisoft/yii2(Packagist) = 2.0.2 No fix listed
yiisoft/yii2(Packagist) = 2.0.3 No fix listed
yiisoft/yii2(Packagist) = 2.0.4 No fix listed
yiisoft/yii2(Packagist) = 2.0.5 No fix listed
yiisoft/yii2(Packagist) = 2.0.6 No fix listed
yiisoft/yii2(Packagist) = 2.0.7 No fix listed
yiisoft/yii2(Packagist) = 2.0.8 No fix listed
yiisoft/yii2(Packagist) = 2.0.9 No fix listed
Show 45 more
ProductAffected versionsFixed in
yiisoft/yii2-dev(Packagist) >= 2.0, < 2.0.14 2.0.14
yiisoft/yii2-dev(Packagist) = 2.0.0 No fix listed
yiisoft/yii2-dev(Packagist) = 2.0.0-alpha No fix listed
yiisoft/yii2-dev(Packagist) = 2.0.0-beta No fix listed
yiisoft/yii2-dev(Packagist) = 2.0.0-rc No fix listed
yiisoft/yii2-dev(Packagist) = 2.0.1 No fix listed
yiisoft/yii2-dev(Packagist) = 2.0.10 No fix listed
yiisoft/yii2-dev(Packagist) = 2.0.11 No fix listed
yiisoft/yii2-dev(Packagist) = 2.0.11.1 No fix listed
yiisoft/yii2-dev(Packagist) = 2.0.11.2 No fix listed
yiisoft/yii2-dev(Packagist) = 2.0.12 No fix listed
yiisoft/yii2-dev(Packagist) = 2.0.12.1 No fix listed
yiisoft/yii2-dev(Packagist) = 2.0.12.2 No fix listed
yiisoft/yii2-dev(Packagist) = 2.0.13 No fix listed
yiisoft/yii2-dev(Packagist) = 2.0.13.1 No fix listed
yiisoft/yii2-dev(Packagist) = 2.0.13.2 No fix listed
yiisoft/yii2-dev(Packagist) = 2.0.13.3 No fix listed
yiisoft/yii2-dev(Packagist) = 2.0.2 No fix listed
yiisoft/yii2-dev(Packagist) = 2.0.3 No fix listed
yiisoft/yii2-dev(Packagist) = 2.0.4 No fix listed
yiisoft/yii2-dev(Packagist) = 2.0.5 No fix listed
yiisoft/yii2-dev(Packagist) = 2.0.6 No fix listed
yiisoft/yii2-dev(Packagist) = 2.0.7 No fix listed
yiisoft/yii2-dev(Packagist) = 2.0.8 No fix listed
yiisoft/yii2-dev(Packagist) = 2.0.9 No fix listed
yiiframework = 2.0.0 No fix listed
yiiframework = 2.0.0-alpha No fix listed
yiiframework = 2.0.0-beta No fix listed
yiiframework = 2.0.0-rc No fix listed
yiiframework = 2.0.1 No fix listed
yiiframework = 2.0.2 No fix listed
yiiframework = 2.0.3 No fix listed
yiiframework = 2.0.4 No fix listed
yiiframework = 2.0.5 No fix listed
yiiframework = 2.0.6 No fix listed
yiiframework = 2.0.7 No fix listed
yiiframework = 2.0.8 No fix listed
yiiframework = 2.0.9 No fix listed
yiiframework = 2.0.10 No fix listed
yiiframework = 2.0.11 No fix listed
yiiframework = 2.0.11.1 No fix listed
yiiframework = 2.0.11.2 No fix listed
yiiframework = 2.0.12 No fix listed
yiiframework = 2.0.13 No fix listed
yiiframework = 2.0.13.1 No fix listed

References