PT-2022-26152 · Yii · Yiisoft/Yii

Fi3Wey · Published 2022-11-21 · Updated 2022-11-30 · CVE-2022-41922

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions yiisoft/yii versions prior to 1.1.27

Description The issue allows for Remote Code Execution (RCE) if the application calls unserialize() on arbitrary user input.

Recommendations For versions prior to 1.1.27, upgrade yiisoft/yii to version 1.1.27 or higher. As a temporary workaround, consider avoiding the use of unserialize() on arbitrary user input until a patch is applied. Restrict access to user input that could be used to exploit this issue to minimize the risk of exploitation.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2022-41922

GHSA-442F-WCWQ-FPCF

Affected Products

Yiisoft/Yii

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41922.json · Exploit
• https://github.com/yiisoft/yii/commit/ed67b7cc57216557c5c595c6650cdd2d3aa41c52 · Patch
• https://osv.dev/vulnerability/CVE-2022-41922 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41922 · Security Note
• https://osv.dev/vulnerability/GHSA-442f-wcwq-fpcf · Vendor Advisory
• https://github.com/yiisoft/yii/security/advisories/GHSA-442f-wcwq-fpcf · Note
• https://github.com/yiisoft/yii · Note
• https://t.me/cibsecurity/53441 · Telegram Post
• https://t.me/cvenotify/38341 · Telegram Post