PT-2023-30334 · Yiisoft · Yii

Ma4Ter222 · Publicado 2023-11-14 · Atualizado 2023-11-20 · CVE-2023-47130

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions yiisoft/yii versions prior to 1.1.29

Description The issue allows for Remote Code Execution (RCE) if the application calls unserialize() on arbitrary user input. An attacker may leverage this to compromise the host system.

Recommendations For versions prior to 1.1.29, upgrade to version 1.1.29 or higher. As a temporary workaround, consider avoiding the use of unserialize() on arbitrary user input until the issue is resolved. Restrict access to sensitive areas of the application to minimize the risk of exploitation.

Exploit

Correção

RCE

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

CVE-2023-47130

GHSA-MW2W-2HJ2-FG8Q

Produtos afetados

Yii

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/47xxx/CVE-2023-47130.json · Exploit
• https://github.com/yiisoft/yii/security/advisories/GHSA-mw2w-2hj2-fg8q · Correção
• https://github.com/yiisoft/yii/commit/37142be4dc5831114a375392e86d6450d4951c06 · Correção
• https://github.com/yiisoft/yii · Nota
• https://osv.dev/vulnerability/CVE-2023-47130 · Aviso do Fabricante
• https://owasp.org/www-community/vulnerabilities/PHP_Object_Injection · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-47130 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-mw2w-2hj2-fg8q · Aviso do Fabricante