PT-2022-8023 · Unknown · Vova07 Yii2 Fileapi Widget

Vova07 · Published 2022-12-31 · Updated 2024-08-05 · CVE-2017-20158

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions vova07 Yii2 FileAPI Widget versions up to 0.1.8

Description A vulnerability was found in the vova07 Yii2 FileAPI Widget, which has been declared as problematic. The issue affects the run function of the file actions/UploadAction.php. The manipulation of the file argument leads to cross-site scripting. The attack can be launched remotely. This vulnerability only affects products that are no longer supported by the maintainer.

Recommendations For versions up to 0.1.8, upgrade to version 0.1.9 to address this issue. As a temporary workaround, consider restricting access to the run function of the actions/UploadAction.php file until the upgrade is applied. Additionally, be cautious when handling the file argument to minimize the risk of cross-site scripting attacks.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-20158

GHSA-J82X-FH8H-326G

Affected Products

Vova07 Yii2 Fileapi Widget

References · 13

• https://github.com/vova07/yii2-fileapi-widget/releases/tag/0.1.9 · Patch
• https://github.com/vova07/yii2-fileapi-widget/commit/c00d1e4fc912257fca1fce66d7a163bdbb4c8222 · Patch
• https://osv.dev/vulnerability/CVE-2017-20158 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-20158 · Security Note
• https://osv.dev/vulnerability/GHSA-j82x-fh8h-326g · Vendor Advisory
• https://github.com/vova07/yii2-fileapi-widget · Note
• https://vuldb.com/?id.217141 · Note
• https://vuldb.com/?ctiid.217141 · Note
• https://t.me/cvenotify/41056 · Telegram Post
• https://t.me/cvenotify/65000 · Telegram Post
• https://t.me/cvenotify/41564 · Telegram Post
• https://t.me/cvenotify/89303 · Telegram Post
• https://t.me/cibsecurity/55674 · Telegram Post