PT-2015-6215 · Yii · Yii Framework

Samdark + 1 · Published 2015-05-14 · Updated 2022-05-17 · CVE-2015-3397

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Yii Framework versions prior to 2.0.4

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via vectors related to JSON, arrays, and Internet Explorer 6 or 7.

Recommendations For versions prior to 2.0.4, update to version 2.0.4 or later to resolve the issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2015-3397

GHSA-W2XX-JP9F-GP8G

Affected Products

Yii Framework

References · 9

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/yiisoft/yii2/CVE-2015-3397.yaml · Exploit
• https://github.com/yiisoft/yii2/blob/2.0.4/framework/CHANGELOG.md · Patch
• http://yiiframework.com/news/86/yii-2-0-4-is-released · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-3397 · Security Note
• https://osv.dev/vulnerability/GHSA-w2xx-jp9f-gp8g · Vendor Advisory
• http://securityfocus.com/bid/74663 · Note
• https://web.archive.org/web/20210122155403/http://securityfocus.com/bid/74663 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3397 · Note
• https://yiiframework.com/news/86/yii-2-0-4-is-released · Note