PT-2023-30334 · Yiisoft · Yii

Ma4Ter222 · Published 2023-11-14 · Updated 2023-11-20 · CVE-2023-47130

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions yiisoft/yii versions prior to 1.1.29

Description The issue allows for Remote Code Execution (RCE) if the application calls unserialize() on arbitrary user input. An attacker may leverage this to compromise the host system.

Recommendations For versions prior to 1.1.29, upgrade to version 1.1.29 or higher. As a temporary workaround, consider avoiding the use of unserialize() on arbitrary user input until the issue is resolved. Restrict access to sensitive areas of the application to minimize the risk of exploitation.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2023-47130

GHSA-MW2W-2HJ2-FG8Q

Affected Products

Yii

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/47xxx/CVE-2023-47130.json · Exploit
• https://github.com/yiisoft/yii/security/advisories/GHSA-mw2w-2hj2-fg8q · Patch
• https://github.com/yiisoft/yii/commit/37142be4dc5831114a375392e86d6450d4951c06 · Patch
• https://osv.dev/vulnerability/CVE-2023-47130 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-47130 · Security Note
• https://osv.dev/vulnerability/GHSA-mw2w-2hj2-fg8q · Vendor Advisory
• https://github.com/yiisoft/yii · Note
• https://owasp.org/www-community/vulnerabilities/PHP_Object_Injection · Note