CVE-2018-6010 Yii Framework reflected Cross-site Scripting
HighCVSS 7.5
EPSS 2.9%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
In Yii Framework 2.x before 2.0.14, remote attackers could obtain potentially sensitive information from exception messages, or exploit reflected XSS on the error handler page in non-debug mode. Related to base/ErrorHandler.php, log/Dispatcher.php, and views/errorHandler/exception.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| yiisoft/yii2(Packagist) | >= 2.0.0, < 2.0.14 | 2.0.14 |
| yiisoft/yii2(Packagist) | = 2.0.0 | No fix listed |
| yiisoft/yii2(Packagist) | = 2.0.1 | No fix listed |
| yiisoft/yii2(Packagist) | = 2.0.10 | No fix listed |
| yiisoft/yii2(Packagist) | = 2.0.11 | No fix listed |
| yiisoft/yii2(Packagist) | = 2.0.11.1 | No fix listed |
| yiisoft/yii2(Packagist) | = 2.0.11.2 | No fix listed |
| yiisoft/yii2(Packagist) | = 2.0.12 | No fix listed |
| yiisoft/yii2(Packagist) | = 2.0.12.1 | No fix listed |
| yiisoft/yii2(Packagist) | = 2.0.12.2 | No fix listed |
| yiisoft/yii2(Packagist) | = 2.0.13 | No fix listed |
| yiisoft/yii2(Packagist) | = 2.0.13.1 | No fix listed |
| yiisoft/yii2(Packagist) | = 2.0.13.2 | No fix listed |
| yiisoft/yii2(Packagist) | = 2.0.13.3 | No fix listed |
| yiisoft/yii2(Packagist) | = 2.0.2 | No fix listed |
| yiisoft/yii2(Packagist) | = 2.0.3 | No fix listed |
| yiisoft/yii2(Packagist) | = 2.0.4 | No fix listed |
| yiisoft/yii2(Packagist) | = 2.0.5 | No fix listed |
| yiisoft/yii2(Packagist) | = 2.0.6 | No fix listed |
| yiisoft/yii2(Packagist) | = 2.0.7 | No fix listed |
| yiisoft/yii2(Packagist) | = 2.0.8 | No fix listed |
| yiisoft/yii2(Packagist) | = 2.0.9 | No fix listed |
| yiiframework | = 2.0.0 | No fix listed |
| yiiframework | = 2.0.0-alpha | No fix listed |
| yiiframework | = 2.0.0-beta | No fix listed |
Show 17 more
| Product | Affected versions | Fixed in |
|---|---|---|
| yiiframework | = 2.0.0-rc | No fix listed |
| yiiframework | = 2.0.1 | No fix listed |
| yiiframework | = 2.0.2 | No fix listed |
| yiiframework | = 2.0.3 | No fix listed |
| yiiframework | = 2.0.4 | No fix listed |
| yiiframework | = 2.0.5 | No fix listed |
| yiiframework | = 2.0.6 | No fix listed |
| yiiframework | = 2.0.7 | No fix listed |
| yiiframework | = 2.0.8 | No fix listed |
| yiiframework | = 2.0.9 | No fix listed |
| yiiframework | = 2.0.10 | No fix listed |
| yiiframework | = 2.0.11 | No fix listed |
| yiiframework | = 2.0.11.1 | No fix listed |
| yiiframework | = 2.0.11.2 | No fix listed |
| yiiframework | = 2.0.12 | No fix listed |
| yiiframework | = 2.0.13 | No fix listed |
| yiiframework | = 2.0.13.1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com
- github.com issue-tracking patch third-party-advisory
- github.com patch
- github.com exploit
- github.com product
- www.yiiframework.com
- github.com