PT-2015-6215 · Yii · Yii Framework

Samdark + 1 · Publicado 2015-05-14 · Atualizado 2022-05-17 · CVE-2015-3397

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Yii Framework versions prior to 2.0.4

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via vectors related to JSON, arrays, and Internet Explorer 6 or 7.

Recommendations For versions prior to 2.0.4, update to version 2.0.4 or later to resolve the issue.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2015-3397

GHSA-W2XX-JP9F-GP8G

Produtos afetados

Yii Framework

Referências · 9

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/yiisoft/yii2/CVE-2015-3397.yaml · Exploit
• https://github.com/yiisoft/yii2/blob/2.0.4/framework/CHANGELOG.md · Correção
• http://securityfocus.com/bid/74663 · Nota
• http://yiiframework.com/news/86/yii-2-0-4-is-released · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-3397 · Nota de Segurança
• https://web.archive.org/web/20210122155403/http://securityfocus.com/bid/74663 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3397 · Nota
• https://osv.dev/vulnerability/GHSA-w2xx-jp9f-gp8g · Aviso do Fabricante
• https://yiiframework.com/news/86/yii-2-0-4-is-released · Nota